“TXT files are also assumed by anti-virus software, firewalls, and even Mac’s own Gatekeeper as safe downloads that can’t possibly be malicious.”
TextEdit sniffs a plain text file, decides it is HTML, and renders it. Gatekeeper never quarantines it because it is just text. An AutoMount path turns a local file URL into a network call that leaks your real IP, even out of Tor. The one file type everyone trusts was the one nobody checked.