Actually yes, in the (old) past they where not only "sloppy" but some (view?) where even malicious in _creating_ a virus which only theire program could handle (but which also didn't do much damage besides annoying the user).

Through instead of sloppy I would say it's often more on the line of misguided about what is secure and _overconfident_ about their own skill to write code without security vulnerabilities. And if the are no vulnerabilities no sandboxing is needed right (sarcasm).

Through there where and hopefully still are exceptions to this. But don't ask me which ones because I haven't been on Windows for a long time.