To that point, all user submitted content has a new and unseen hash, and could become executable in the face of a zero day in otherwise trusted code that is processing it. This is equally true of web applications and Excel attachments to emails.

People who think the top level poster’s approach to security is sufficient are gravely mistaken.