I mean I was thinking more about the thing were WMF files used to allow you to run scripts inside the files which created security issues https://www.computerworld.com/article/2826084/what-you-need-... - lots of functionality that is enabled to make things easier for applications to do stuff is fundamentally insecure, so pushing a solution to fix the security issue will sometimes lead to remove functionality from the application that the user has to accept.

So the premise that we could remove security issues but not touch functionality seems utopian.