IIRC, when Windows file browser sees a .exe file, it looks inside the file for the program's icon and only uses the window thing if it doesn't find one. Nothing stops the program's icon from being the same as a Word doc.

The file browser just looks at the extension, rather than the file header, so yes.

This can be tested by creating a dummy .txt file and changing it's extension -- the icon changes although file contents remain the same.

The extension is still .exe, though. It only _looks_ like .doc after font rendering. And so, as the OP suspected, the .exe needs to have the proper icon embedded. It's not provided by the file browser.

So it seems like one important thing that Windows (or any OS) should do is to not display custom icons for untrusted executables.