The problem is notepad itself would download and execute bad stuff if you click the evil link. If you would paste that same link in a browser you'd be ok.

And the problem is a notepad app is expected to be dead simple, have few features, and be hard to get wrong while implementing.

So Notepad will download and execute itself rather than launch an appropriate application to handle the URL? That was not clear to me.

It could be. But why is notepad doing anything other than rendering text? I don't expect it to make links clickable, or render markdown.

That was old Notepad. This is new Notepad.

I think my comment still stands though. Why is "new" Notepad getting new features? It was perfect as it was.

Programmers and their managers need food. And other nice things.

Don't programmers now just get fed tokens?

/s

Just imagine all the problems that wouldn't have occurred of email remained text only!