But Parquet is intended to be a safe format. So importing a malicious file should still be safe.

Like if a browser had a vulnerability parsing HTML of course it is a major concern because very often browsers to parse HTML from untrusted parties.