This guy is hilarious.
It doesn't show how he obtained the necessary permissions to delete things off that guy's machine, which most likely required administrator access. It just shows that the scammer "Kevin" is connected to a virtual machine the other guy is running, via teamviewer. Since the person producing the video is hacking the scammer, he's not doing it from a machine containing his personal data or information. The scammer can't do much to him.
There are various security issues with VMs when it comes to stacking hypervisors, since you have to emulate things like
ring 0, so that the slave hypervisor believes it has root privileges. I can't tell you the rest though.
I will tell you the scammer is an idiot here, as he's doing something inherently risky without appropriate security measures on his end.
On a side note, I agree with some of the comments. These guys should get a Netflix show.