I suppose it had, but as a large codebase written in a memory-unsafe language with unrestricted system access, in an era where browser plugins weren't sandboxed

I suppose it had, but as a large codebase written in a memory-unsafe language with unrestricted system access, in an era where browser plugins weren't sandboxed by design, it was a cat and mouse game.