vim used to have similar vulnerabilities (maybe still does?) via modelines:

https://security.stackexchange.com/questions/36001/vim-model...

https://lwn.net/Articles/20249/

Circa 2002-2003, and the LWN comment describing the exact same scope:

"""emacs is the same, if not worse. (See the node File Variables in the info docs.) You get not only to set random buffer-local variables, but also to evaluate arbitrary lisp code. Ouch!"""

At least for file variables, Emacs prompts before loading untrusted values.

Someone took the first tomato!