It's been a while since I lived in windows-land, but .hta iirc uses a trust zone that can be locked down to disallow the functionalities that usually allow hta malware to gain a foothold.