Autorun ran automatically because it made sense back then since there were no recordable CDs yet. It was assumed that no one would put malware onto a pressed CD, except, apparently, Sony.

Starting with, iirc, XP, Windows started prompting you whether you'd like to run the autorun.