Thanks for sharing this. I like how he mentioned one of my biggest hangups about not being able to control apple events.
Of course, sadly I think the only way to really implement that would be to change the file extension ... again. Its the only way I can truly see enforcing the new capabilities is to forgo the backwards compatibility. I don't really relish the thought of updating all of the files again though.
I don't think it would be necessary to change the file format to improve security options for outside API's and events.
Currently, we can still control them. The secret sauce is having well thought out, granular privilege sets. Apple events can't do anything if the privilege set doesn't allow it.
I still stand by my thoughts we should be able to completely disable it if we will never had need for it though. We don't even have Macs in our environment so there isn't a good way for us to test it. We would never have to test it if we could just say nope can't use it.
Thanks for posting this, Josh!