imagine a world where "email attachments from unknown senders" were this scary magical thing of danger, and no other emails were dangerous.

Now imagine how many security docs pretend that's the real world