I think his point was that this exploit was done outside of a browser sandbox, which places it in a whole new category of security issues. You could just as ea

I think his point was that this exploit was done outside of a browser sandbox, which places it in a whole new category of security issues. You could just as easily say this is microsofts fault for not applying stricter policies on activex controls within office products.