When done properly, this is less of an attack vector than you think (certainly much less than a phishing email).