What? No it isn't. It's because the users think they're opening a document to look at some data and suddenly it's an executable transferring money via their bank account.

And that's all working as designed. Someone built it like that. There's no bug anywhere in that chain, just as extremely rickety system with no affordances for human intervention. No separation of what is trusted and what is not.