We must be talking about a different 1990s. It’s true that before then it was easier to get away with bad security due to few computers being networked, and it

We must be talking about a different 1990s. It’s true that before then it was easier to get away with bad security due to few computers being networked, and it took a while for eg buffer overflows to be exploited (smashing the stack for fun and profit was November ’96). But in the first half of the decade or so there were lots of vulnerabilities found in sendmail and suchlike.