They really should have, but this is understandable. Old vector formats are always a security nightmare - The original parsers / renderers where written on sin

They really should have, but this is understandable. Old vector formats are always a security nightmare - The original parsers / renderers where written on single user systems and focussed on rendering speed. They didn't anticipate hostile files. - The original developers are long gone. - EMF files were never popular on websites. I would argue that their real mistake was adding EMF / WMF support to IE in the first place. It made sense to developers because it was only a few lines of code, but it was a terrible decision for security.