It's a single user OS that runs everything in ring zero by design. I'm not sure, definitionally, that it can have security vulnerabilities. I... guess maybe code execution on exposure to an untrusted floppy disk filesystem?
It was a different era entirely; Writing a TSR was a right of passage. Sometimes just getting something to work without having any other motive was enough to do it.
A clever and small TSR might keep a copy of itself in memory and not require two floppies in the case of no hard drive. In comparison to today’s standards, it’s amazing what we did with 640k (or less!) of ram.