I read it more as "don't implement JS, 3D object rendering, slideshow transitions, sound annotations and the other 999 insane features that I'm not even aware exist"

I think he just means disable any of the "advanced" features mentioned above like accessing web content, running custom scripts, etc etc. You might still be vulnerable to any dependencies they use for image rendering itself but I bet it would make it drastically more safe.

Then just have a button for turning those on as needed on a case by case basis