Well fuck me. This is an interesting theory.
I'd be looking for patches in Microsoft Word with triggers so it only happens on certain networks, domains or machine configurations.
It may be possible to do this in the printer drivers, too. Then the bad actors would need to be the IT guys installing printer drivers. Plausible weakness.