"Fonts can be malicious" made me think of security vulnerabilities in font engines that can be exploited remotely by untrusted websites through things like webfonts. That doesn't necessarily involve Turing completeness, just some bogus memory handling in a font library written in C for instance.