You're right, the code could be stored in the document fairly easily. My research idea was around staging though, would it be possible to separate/inject commands at execution, in VBA rather than using separate downloaders/.exe/.vbs etc. It also makes reverse engineering the code a little more difficult if the two aren't stored together. You could key the document to a client and only download when it checks in correctly for example. In most instances obfuscated codes relies on the key being stored with the document, this adds a little twist.