Not quite. ActiveX would download and run unsandboxed native code direct from the web, even if it wasn't installed. The security mechanism was a popup dialog that contained the publisher name as verified by a code signing certificate.
This is how I remember it. I was dealing with early 2000s smart home software that used ActiveX. I'd visit a website in IE, press ok, and run their "web app" that had raw access to my serial and ethernet ports. It was bizarre even for back then.
Turns out nearly every extension had gaping security holes.