Pretty funny how any format can be a vector for miscreants. I wonder if this is a testament to Apple’s security in preventing more obvious vectors, or insecurity for allowing this to continue.
I wonder if Google ever did something about their similar problem:
I was targeted with this trash, it disappeared late 2019.
I have been getting emails lately about so-and-so resolved a comment in google docs, where the comment/doc is about some pharmaceutical spam. Any way someone can send a message to a mailbox is a potential spam vector.