Honestly if if a big enough organisation hasn't disabled untrusted Word macros by policy several years ago their odds of being ransomware victims by now would be close to 100%, and based on what I've seen the odds of having been victims 10+ times are pretty high. One new malware in this space isn't game changing, and new fully undetectable variations show up every day.
I find it kind of astonishing that Word documents have been an attack vector (a) in the first place and (b) for as long as they have without a sealing patch. Like, why do I need my word document to contain any sort of RPC invoking capability.
eBPF has landed in a lot of monitoring/observability use cases. Microsoft has worked on porting eBPF to Windows. I speculate this "undetectable" backdoor problem may be solved with that combination.
What if PowerShell itself <i>is</i> the backdoor? You can remove PowerShell from Windows as a hardening/mitigation strategy. I do it on all my systems. I regularly see threat hunters disclosing how 99% of malware leverages the shit out of PowerShell to drop payloads.