The right right question would be: why aren't we enforcing a document to be self-contained? Why are documents agents? Why can any document access anything or indeed, do anything? That's not a document, that's a program!
The right right question would be: why aren't we enforcing a document to be self-contained? Why are documents agents? Why can any document access anything or indeed, do anything? That's not a document, that's a program!
Documents containing scripts are genuinely useful, as are, say, Python programs.
A python program isn't a word document
People write real software using Microsoft Office's scripting features. Sure, it's not "cool" the way that Python is cool, but it works.
And neither Microsoft nor Python has a credible security model.
They shouldn't be able to do that, because it's a huge security hole.