Pretty much everyone opened the docs, including the CTO. If you're more comfortable on Windows, that's fine, use Windows, but remember that you're using Windows.
I wouldn't blame windows, surely libreoffice could.be exploited similarly?
Perhaps? I don't use either package. If someone sends me a .doc and I really want to read it then I upload to GDrive. If I'm sending something that can't be text then it's a pdf. I'm not saying I can't be phished, but I certainly won't be running any VBA without knowing it.