That's a different potential vulnerability. I knew about that one (and had disabled the running of such scripts). I didn't know about this one till today.

Helping me finish typing the name of a function or variable ("completion") is not the sort of thing I expected (till today) the maintainers of Emacs to be so eager to do that they'd start running code that I never asked to be run.

It's that Lisp data is code, code is data thing.