Until recently, fonts were something that either came from the vendor, or which installed like software. So they weren't considered to be an exploitation vector

Until recently, fonts were something that either came from the vendor, or which installed like software. So they weren't considered to be an exploitation vector, any more than installing any software is an vulnerability. It's only in the last several years with loadable web fonts that the font rendering code has needed armoring against malicious font files.