It's not a security boundary, just something to stop users accidentally opening an email attachment like they will with bat/vbs.