I don't think this is a bad observation.  My slant on it is, if you are maintaining backwards compatibility to a point in time where these things just didn't matter, because only one person used the machine, there were no multiple user accounts, and the machine was not on a network... it's unsurprising that such an environment would be rife with security holes.  Not saying it'a acceptable, just that it's not surprising.<p>Edit: and it appears there's an effective way to mitigate this, disable the 16-bit support in group policy.