"Linux would require the user to manually save the file [...] explicitly marking the file as executable." ZIP attachments preserve executable flags. Also, sym

"Linux would require the user to manually save the file [...] explicitly marking the file as executable." ZIP attachments preserve executable flags. Also, symlink traversal attacks only require a ZIP attachment to be clicked. Apple patched macOS for this a little while ago, but it's probably still a thing on many systems - since most email providers know to detect ZIP directory traversals, but not ZIP symlink traversals. There's also a range of other containers for macOS and Linux which will preserve executable flags if you ask them to. And we have also seen simple character encoding attacks which can crash Apple Mail just on viewing the email.