[whimsicalism]

> Sorry, CVE database disagrees with you when looking at the statistics of how often RCE macro loopholes are found in embedded VBA APIs inside spreadsheets.

Sure, but there's a difference between having a large codebase to cover and what is being discussed above. Nothing you've said is contrary to GP.

I am willing to counter any bet that Excel formulas will open an external program without prompting.