You are mistaken: > The malicious code would execute in the security context of the user who opened the Markdown file, giving the attacker the same permissions

You are mistaken: > The malicious code would execute in the security context of the user who opened the Markdown file, giving the attacker the same permissions as that user.