Great comment, this expands the issues really well for me. I didn't notice before that this was supposed to be a safe api usable without permission, that indee

Great comment, this expands the issues really well for me. I didn't notice before that this was supposed to be a safe api usable without permission, that indeed changes things. Antivirus software often reads all files coming to the system, run with admin / kernel driver privileges, and still has lots of parsing and other vulnerabilities (project zero blog wrote about some of these). They tend to try to unwrap all container formats. I wonder if they'll start diving into SQLite files used by browsers and that way manage to expose their privileged attack surface to malicious web content.