Regardless of whether this is true (I don't think it is), it's probably not the right metric: even if Microsoft Word was completely offline and had no way to make Internet connections (it does), memory unsafety in it is exploitable by getting a user to open a file.

(And the funny thing about "trusted" communications: they're trusted until an attacker figures out how to store and forward untrusted data, at which point a logic error in the server itself is now nicely composable with code that "didn't need" to be particularly memory safe.)