Security researchers say the choice by Microsoft to re-enable Office macros by default is "puzzling."