Honestly you could probably do it today, but back then it would have been a lot harder. You’d have to find every buggy use after free. Just easier to change the allocator for it. Probably how you’d do it today under emulation.