AimIsADickturbochad69Valve fixed this 6 months ago in tf2: https://i.imgur.com/XbI1hPU.png, would post the link but you actually already posted it lol
It's a very very foolish mindset to assume that there aren't bugs leading to rce in any software, let alone a c++ codebase from 2004, with old versions of 3rd party libraries, that valve has been adding to in the way that they have.
This specific bug in XZip has been found and patched, there are undoubtedly many more similar bugs in other parts of Source/tf2, and you should assume the same for nearly any software.
Seems that Valve only patched the steam invite RCE for TF2. What about CS:GO? What about the other RCEs?
good call, they most likely just forgot to patch the RCE in csgo, their most popular game except for maybe dota