Why would a tool that runs any program sent to it on a device it doesn’t know about be that concerned about being sent an invalid program?

An attacker might send a file that orders for millions of dollars of pizzas, using the fax hardware built into the printer (I’m not sure you can buy postscript printers that can fax today, but you can buy printers that can fax even today)