Indeed, they are not heavy excel users. Which is sort of the point: the need for targeted attacks greatly reduces and segments the addressable “market” for the bad guys.

Nah. Point stands, attack can survive the restore inside Office docs because macros are generally allowed.