There was in fact an exploit based on Fonts that made the news years ago so it is still true that a font can do what you noted. Back to the company that supplied the font to ask them to test their font.