That's very interesting but I have to disagree with the response. The vuln might be used iirc to bypass signature verification of the PE? It might also possibly be used to evade sandbox analysis of malware, AV heuristics and ML based approaches might also be thrown off guard.

But yes, It would have been a lot more interesting if there are cases where the executable is attacker controlled and the exploit would end up running code as the privileged parent process or some other user that has more rights.

Change the scenario to "download it and double click it, exploiting vuln in file format handler" and it's correct.

That is actually a serious issue especially if you allow unicode and RTL override in the file name. Always validate input file type.