The main problem and is that the file open dialogue generally runs in the app's memory space, at which point we can't stop the app corrupting it in any way it likes.
I hope we are moving to a world where apps are built of seperate processes, most of which have minimal access. If nothing else, this will make many old buggy C libraries (including code I have written) much less dangerous.
What the parent comment (and some siblings) are saying is that the file open dialog's behavior can probably be modified by the application that calls it, e.g. faking the effect of the user clicking Open on every single file.
That could maybe be prevented by keeping the relevant sections of memory marked as read-only, and maybe it already is.
I hope we are moving to a world where apps are built of seperate processes, most of which have minimal access. If nothing else, this will make many old buggy C libraries (including code I have written) much less dangerous.