It can be done. See the documentation for SES21 (Simple Emacs Spreadsheet) that explains counter-measures against such a thing. AFAIK, it's never actually been done, though.

''How would one go about doing it? I have seen documents with autorunning Elisp code embedded, but Emacs asks me whether I want to run them.''

Do you look at the code before saying "yes"?

''Yes, of course. Point taken, though''