Why? It doesn't do anything you couldn't do by taking a photo and spending the time to type it in manually.

Of course it does. Maybe I'm misunderstanding you, but you seem to be dismissing time as a security factor, when it is, in fact, the only security factor that counts.

We don't (can't) rely on an encrypted volume being perfectly secure. We rely on it taking an infeasibly long time to crack.

We don't (can't) rely on a weapons vault to be perfectly secure. We rely on it taking enough time to breach that authorities will show up.

And companies don't (can't) rely on their data being perfectly secure. They rely on it taking an infeasibly long time to collect.

Technology like this is useful. I will likely end up using it. But technology like CSLI is useful too, especially when integrated into E911 and the like. And yet, when sensitive "information is detailed, encyclopedic, and effortlessly compiled," it poses other risks.

What's the attack vector here? Excel?

Data collection. I can see MS collecting all kinds of "metrics" to "improve user experience". That is assuming all processing happens in the phone and not in the cloud in the first place, which the article does not mention.

You already have to trust MS implicitly if you're using Excel though. And imagine how many .xlsx files are flowing through OneDrive already, filled with passwords, PII, SSNs, etc.

That is true, but at least one can use Excel offline or isolate the process from networking for a decent level of security.