You could argue that, but I wouldn't recommend it.

Microsoft has a massive amount of resources to throw at securing their environment, whereas most businesses simply don't have the ability to field a dedicated security team. The solution many reach is to offload risk to your software vendor, in this case Microsoft. Then, if there is data lost, it's Microsoft's fault, and it's their problem to fix, too. It's not ideal, but it's the world we're living in.

Cloud doesn’t have access to local drives…but in this day and age, python could be containerized or sandboxed. Sounds messy though.

But Micro$oft never implement any permission system or checks for Visual Basic in Office so any macro can use anything the user has access to. If the scripting language could only access its document’s content in an undoable way without explicit permissions such as to use the filesystem and Internet or modify the Normal template (as opposed to the current system, which does not differentiate between useful scripts and malware and can easily be bypassed by social engineering), the risk would largely be mitigated but Micro$oft does not care.