It's interesting how much different the landscape was in that era: single-device residential environments would have no firewall at all (just a PC with a publicly-routable IP address) and dial-up kind of fueled this due to PCI slot modems, but as the outboard nature of DSL and DOCSIS modems made it easier to build multiple-device residential environments by adding a router, suddenly everyone had a firewall (as a byproduct of NAT). Then you've got malware, which was far more prevalent on PCs through that transition relative to today, but now we've got IoT stuff probably not being updated as it ought to be, potentially hosting malware that serves as a proxy to sidestep an in-router firewall.

Behind a NAT.

Can't remember a single problem with the described setup and I've been using the internet since dial-up was the only option available.

Getting hacked when you don't have any open ports (thanks to NAT) is and was pretty unlikely - what was more likely is some kind of drive-by exploit in Flash or IE. The biggest problem I experienced with old Windows was general instability in the form of BSODs and driver compatibility problems.

NAT has nothing to do with security and it was common that people had a single device on DSL or cable plugged directly into the modem; routers were not common place at home.

NAT was for fancy-pants with multiple PCs.

Yeah, I remember formatting the HD on a PC back then to do a fresh install of Windows XP.

The CD-ROM I had was pre-SP2 (so no firewall), and our internet setup was basic modem + switch. No router with “drop invalid state” or fancy things like that.

So, installed Windows and plugged in Ethernet to fetch Windows updates.

2 minutes later, with no user interaction whatsoever, the PC was infected with malware.