What they are doing instead, shifting responsibility to end users. Specifically, they're simply training users to click on "I agree" buttons.
Are macros at all common? My perception is they're very very rarely used, especially in file downloaded from the internet. In that context, a file asking for permission to run macros would seem pretty strange to the user and that they might actual reconsider things before clicking I agree.
To answer your question though, pretty much every place I've worked with had people writing VBA macros.
I always ask orgs to consider a blanket ban on them but almost none can go that far. They are extremely widely used and shared among healthcare, pharmaceutical, government councils and many other types of organisations.
In traditional business (like banking, where I have my experience) macros are EXTREMELY common. Both in local files, and in what normal users would consider remote files (from intranet sites and email).
It's even worse IMO. Want to copy the value Excel is displaying in a cell to the clipboard? Gotta click agree to enable macros! WTF?!
That way, it would be clear for users that they are not "opening a document" but "execute a program".
There simply is no need to conflate documents and programs.
The problem of course is the legacy of .doc, which is both of those in one filename.
However, sandboxing is a much higher investment from MS’ POV. This feels like they’re making this move specifically to distract from the fact that they should have made the tech investment into sandboxing today.
cough
https://docs.microsoft.com/en-us/windows/security/threat-pro...
That's been built into Windows 10 Pro since Dec 2018.
Office “Sandboxing” is a thing today.