I have my own (related) questions, but I do have theories, that may or may not answer;
0. My gut says this is somehow related to indexing/thumbnail rendering. But maybe I'm off base.
1. The 'no user interaction' could be related to (ironically) some background pre-indexing process that windows is doing on files inserted to folders.
1.1. LOL maybe their bullshit 'Windows Copilot' which is why the description is so vague, don't want to torpedo things worse than they already are.
2. It could also be, still in the category of 'well, ok they click on a share folder and the preview runs' or a weird edge thing.
2.1. But they aren't being that clear yet, probably because it's bad.
The advisory from Microsoft specifically says it can be exploited over the network with zero user interaction.
The vulnerability predates Copilot. Paint's first vulnerable version (11.0) was released September 2021, Copilot in February 2023.