Which is why he specifically said "powershell embeds without any security warning", I suspect. :|
https://blog.netspi.com/15-ways-to-bypass-the-powershell-exe...
Yes it did. It always had default execution policy to not allow scripts to execute. Not sure how it was set in the Monad days before PowerShell 1.0 was released, but for as long as it has been called PowerShell, execution policy has been part of it.
On top of that, the .ps1 file extension is associated with notepad - not the PowerShell interpreter. When you "invoke" a ps1 file (like double-clicking it or have some program like outlook take default action), Windows will open notepad unless you explicitly associates .ps1 with another program.
A) An argument to powershell.exe which Office will not supply when executing the ps1 file or
B) Interacting with the powershell window after it's opened (which you can't do without already having some sort of code execution) or
C) The execution policy being set to something that allows unsigned code.
A and B are impossible, and C can be locked down with group policy to the point that local administrator rights can't bypass.
Executing a ps1 with the appropriate parameters after executing something else may be possible, but also redundant.