Well, yes, I would not consider arbitrary documents as "pure data" - for that I was thinking as something like a dump of a particular database table contents on

Well, yes, I would not consider arbitrary documents as "pure data" - for that I was thinking as something like a dump of a particular database table contents only, separate from all the database structure/metadata/triggers/functions/etc. You could restore a dump of pure structured data to a known clean system and that would be safe - but once you include arbitrary files as you describe, no way. Embedding malware in some periodically-accessed document on a public file share is a reasonable persistance mechanism for an attacker.