The idea is that general Excel files do not run macros. They need to be saved with a special extension and you need to manually approve macros, with warnings if the file is in a location where other users can write to the file.

I have no idea how watertight this is though, it’s Microsoft quality (and some of the most ancient code they have) so I wouldn’t bet the farm on it.