It's not, but there's a flexibility/security tradeoff there. If data isn't tightly bound to an app and just exists in files that any app can read and write from, you get confused-deputy attacks where a malicious app can construct a document that's interpreted in a different way by the original program and can then do something nefarious.

This was behind a lot of the MS Word & Excel worms & viruses that made the desktop such a hazardous place in the early 2000s that the web took off. People realized that they could embed VB code or even just formulas in .doc & .xsl files, and the mere act of opening the document (something which was supposed to be safe) would infect all your other files, and let attackers do things like read all your confidential documents and e-mail them to the attacker. Even without scripting languages, you can get surprisingly simple & damaging attacks like rewriting URLs of prominent sites within documents to go to an attacker-controlled domain that looks like the original (using Unicode lookalike characters) and then phishes their login.