And with threaded code attacks you don't even need to download an executable. You can run "script level" code by repurposing existing executable sequences.

Security is hard.