Regardless of whether this is true (I don't think it is), it's probably not the right metric: even if Microsoft Word was completely offline and had no way to make Internet connections (it does), memory unsafety in it is exploitable by getting a user to open a file.

(And the funny thing about "trusted" communications: they're trusted until an attacker figures out how to store and forward untrusted data, at which point a logic error in the server itself is now nicely composable with code that "didn't need" to be particularly memory safe.)

Isn't the whole point of an exploit to go beyond what the software was originally built to do?