People trust their browser nowadays, I'd expect the attack to be even easier if you just render the markdown in html, hiding the injection using plain old css text styling like in the docx but with many more possibilities.
You can even add a nice "copy to clipboard button" that copies something entirely different than what is shown, but it's unnecessary, and people who are more careful won't click that.
But nobody trusts AI. Whenever I leave my circle of engineering people and am along the general public, I hear nothing but contempt for it.
We get rid of some problems, and we get a bunch of new problems instead. And on, and on, and on.