But Micro$oft never implement any permission system or checks for Visual Basic in Office so any macro can use anything the user has access to. If the scripting language could only access its document’s content in an undoable way without explicit permissions such as to use the filesystem and Internet or modify the Normal template (as opposed to the current system, which does not differentiate between useful scripts and malware and can easily be bypassed by social engineering), the risk would largely be mitigated but Micro$oft does not care.