This is Myth. IE’s integration has nothing to do with it’s security.
http://blogs.msdn.com/dmassy/archive/2005/03/22/400689.aspx
The issue of not being part of the Operating System is an interesting one though that is frequently the subject of misunderstanding. IE is part of the Windows Operating System so that parts of the OS and other applications can rely on the functionality and APIs being present. IE in turn relies on Operating System functionality to do it's job. To be clear there are no Operating System APIs that IE uses that are not documented on MSDN as part of the platform SDK and available to other browsers and any other software that runs on Windows. The security of any browser is irrelevant to if it is part of the operating system. If we are to debate security of browsers then let's bring in relevant arguments and accurate details about different possible attacks rather than rely on the irrational fear that because IE is part of the operating system it must be exposing OS functionality to the web. This is not the case as any software has access to the same set of OS APIs and can therefore expose the same set of OS functionality as IE.
I don’t believe it’s a myth.
Dave Massy is a Microsoft employee (Senior Program Manager for Internet Explorer). What else would you expect he’d say?
Edit:
By the way, I just read the entire thread on his blog, that you drew your quote from. He got ripped pretty good, by a whole bunch of people.
That said, I think Microsoft has come a long way with security, and I look forward to seeing what they will have accomplished overall with Vista.
However, for me personally, I think once my old box finally gives up, I’ll probably look seriously at one of the Linux desktop distributions.
Of course you don’t, you want it to be true like all the other Myths. What he states is very clear, using IE does not expose OS functionality to the web. This is one of many irrational fears about IE spread on the Web. Why do you think the IE vulnerabilities that allow an attacker to gain “system access” can only access system functionality based on the security account level?