Some versions of `strings` might try to parse the file as an executable, which could expose one to any vulnerabilities that may be present in the library used to do so.

However, on my Fedora 36 machine at least, it doesn't do so by default and I'd have to specify the `-d` flag for it to do this.

This is a nice summary: https://lcamtuf.blogspot.com/2014/10/psa-dont-run-strings-on...