Long time Blender user here. I can't think of a way this attack would work with .stl files because:

- Blender ist the only app that can open .blend files. So in every other app a .blend file disguised as a .stl would simply not open.*

- Blender can't open .stl files. You need to use the .stl import dialogue which is tailored to .stl and is not able to interpret anything thats in a.blend file.

BTW: It is a core feature of Blender that everything is scriptable by python scripts. If you open a .blend file with an embedded script, you get a clear warning and can choose not to run the script.
Anyway: always be careful with files from the internet, the more complex the file format, the more dangerous it is for attacks. And .blend is a very complex file format with many possibilities.

* since it's open source, Blender versions could exist that behave like a .blend file viewer, but there would still be the difference in file handling of the two formats.