I've raised this point repeatedly in different orgs. It's met with some combination of indifference and lack of understanding and not-my-responsibility-ism, but I'm sure that this will eventually blow up hard in some company's face - like 9-digit settlement for breach of contract, or worse things like breach of export control laws. Enterprise data security on the "MS Office level" at this point is like driving 60 mph…
Yeah, I'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow. HIPAA is a hell of a drug.
I work in healthcare, and the legal department bars me from using Google Analytics for HIPAA reasons.
Meanwhile, IT made Chrome the only browser the employees are allowed to use on every Windows machine in the org.