Everyone waits for your client's next step. Your client can basically pause the game whenever it wants, giving you time to do something.
But there are bigger exploits. IIRC, the client sends separate actions for buying a unit/tech/building and paying resources, and the other clients don't enforce that they go together. This allows malicious clients to buy without paying. It's been seen a few times even in the ranked mode of the Definitive Edition remake. https://www.reddit.com/r/aoe2/comments/fjjudp/cheaters_are_a...
This way of doing things made sense for the time, and the execution was impressive. It was pretty reliable, nobody wanted to cheat anyway, and yes lag was a big problem but there wasn't another good way to do it back then. Nowadays they should have something else IMO.