Unfortunately, I think the explanation for this one is that Steam bypasses a lot of Windows security and can be used as an exploration vector.