Do note that Office 2007 reached it's end-of-life on October of 2017, and therefore doesn't receive security updates anymore. I'd recommend getting a newer version at this point.
[1]: https://arstechnica.com/information-technology/2017/04/booby...
This is a particularly big concern with Word since its data format is essentially a direct binary copy of its memory structures.
https://www.joelonsoftware.com/2008/02/19/why-are-the-micros...
But yeah, to the parent of yours, Office has a lot of features of embedding and triggering dynamic content, and people are constantly finding creative new ways to infect Office files. Security updates for Office is a critical as security updates for your PC.