Oracle has changed the permissions required to run VirtualBox v6.0.0 and later.
With this version, /usr/lib/virtualbox/VirtualBox no longer needs to be suid;
however, a new executable /usr/lib/virtualbox/VirtualBoxVM does need to be
suid.

Rolling out this change may be difficult in that older versions of VB need the
current setup. Is there any way to specify different versions of the
permissions package in the build?

Please be aware that I plan to wait for VB v6.0.2 before pushing the new
version. I would expect that change to happen sometime in the next month. Once
the new version is rolled out to TW/Factory, I will then introduce it to Leap
15.0. As is customary, Leap 42.3 will not get this update.