Would you like to elaborate on those few dozen more cases rather than handwaving them away? Embedding a VM into a font format is foundationally a ridiculous idea and should require real justification, although I know our industry is in love with anything that allows arbitrary code execution exploits.