Wide open, indeed. For those who don’t know:

  - no memory protection.
  - system support for patching OS calls.
  - no distinction in privileges between application and OS code.
  - when mounting any disk, the OS opened a resource file on it
    and kept it open. Side effect was that the OS would look for
    code fragments defining windows, menus, and controls in that
    file. That file normally didn’t contain any, but adding a
    malevolent one to that file would mean the OS would run your
    code as soon as any program created a standard window, menu
    or control. 

(That last part was fixed after a virus exploiting it was found)