CVE-2010-2568, CVE-2015-0096, CVE-2017-8464, CVE-2026-21510... OLE/COM mess from the early '90s and internal assumption that only Microsoft code ever touches the serialised data or calls certain object methods provided some people job security for decades.
