The Exchange side has a higher level of security against...

The Exchange side has a higher level of security against this bug because you have to get authorization to the server. Technically this could happen but there are a number of things that have to line up and the vulnerability doesn't use a typical URL.