Someone once suggested the risk in opening email attachments was analagous to the risk in running executable code (e.g., Javascript) from websites. Each can expose the user to a multitude of vulnerabilities. The argument against this comparison at the time was that Javascript from websites, unlike email attachments, could be run in a "sandbox". Even if the code could not be trusted, it was "safe" because it was "isolated".
Today, many users do not run Javascript because all too often it exposes them to excessive advertising and resource usage. Now, after researchers defeated KASLR with Javascript, and with Meltdown and Spectre being implemented in Javascript, there are additional benefits of not running third party Javascript.