It probably helps that Google's applications encourages their users to open spreadsheets in Google Sheets, instead of office software running on the users' mach

It probably helps that Google's applications encourages their users to open spreadsheets in Google Sheets, instead of office software running on the users' machines. If you work on a web application where users can generate reports that contain input from other users, and a common workflow is for users to download those reports and open them in Excel, they aren't going to be happy if your site is a vector for attacks. Saying "Oh, but it's an attack against your laptop, not against our servers; WONTFIX." is going to be tough to justify.