I can't speak for ActiveX since I avoided IE like the plague, but Java applets were sandboxed. Just that the sandbox had a lot of holes.