It's not so black and white.
Technically you are increasing your risk by adding services and applications that can be compromised. And you do need to patch the office installations, so it does add overhead. If you are wanting to counter the assessment, then you probably need to do a Risk assessment your self and present the findings and mitigations. Be sure to weigh the value of the request against the Risk/Impact of having those items installed.
Examples of how to mitigate some of the risk.
- if the server is internal, your risk of being compromised is less
than if it is exposed to the internet.
- you can restrict access to the bits by locking down which accounts can run the applications or access the DLL's, etc. This lowers the risk that a random domain user account can access and exploit the application.
- Along with Item 2, if feasible you could also restrict the server to
communicating only wiht certain IP's, Subnets, etc.
This assumes other things like the server is already running in least privileged mode and hardened appropriately, you are using Defense in Depth, etc.