That's entirely Microsoft's fault too: they made internal APIs accessible to applications, and did not provide comprehensive documentation on the full features of their public API.
The latter means that application developers were forced to just guess what a function could do. And since no API performs proper input validation, undocumented usage became the norm.