> a vulnerability through vim's mode lines where you could execute pretty random code. Basically, if someone opened the file you could own them.

... Why would Vim be treating the file contents as if they were user input?