We're talking about a company with a security culture where opening a text file in notepad.exe can lead to an RCE.

Assuming reasonable implementation standards at this point is the irrational assumption, not the rational one.