Are the macros in FUNCRES.XLA always safe?

I would consider the Microsoft macros to be safe. But could a hacker
spoof the "funcres" project so that it does not contain the contents
of the official FUNCRES.XLA file, even though it says the source of
the project is FUNCRES.XLA, i.e. the Project Explorer window shows
"funcres (FUNCRES.XLA)"?

The "funcres" project does disappear when I unselect the ATP from the
Add-ins list. But could a hacker detect that (if macros were enbled)
and remove their own spoofed "funcres" project?

I'm afraid I am very naive about the devious things that hackers can
do. In my paranoid ignorance, the realm of things seems infinite and
always possible, albeit infinitessimally probable.