Certain RTF files may attempt to thwart detection by having a malformed RTF header, such as **{\rt000**. Removing 0x66 will result in detecting these malformed yet valid RTFs as well.
Additional reading:
https://www.decalage.info/rtf_tricks#Trick_1:_Incomplete_RTF_Header
