Thing is, security folks noticed autorun was a problem back then.
I can sort of understand what Microsoft was trying to accomplish with it… the mid-90’s were a wild, lawless time with regard to personal computing.
The “wild lawless time” was not the context in which Microsoft made those poor security designs; it was a consequence of those designs — which were noticed and criticized by security folks at the time.
Another entertaining example is the demythification of email viruses.
In the early 1990s, email viruses were a myth: the Good Times virus was a hoax that told people that they could get a virus by reading an email. At the time that hoax went around, this was not actually possible: email software just displayed text; unless you downloaded an attachment and ran it, you couldn’t get a virus in email. Certainly not just by opening and reading an email.
But then along came Microsoft with Outlook Express, and security vulnerabilities that allowed the action of rendering an email, even in a preview pane, to inject malicious code.
Suddenly email viruses were not a myth anymore; they were everywhere.