Even if you can't execute code from RAM, stack corruption and Return-Oriented-Programming (ROP) can still be a thing. It's just far more limited if you can't use ROP to set up regular code.

Memory devices were not accessed via exotic interfaces at the time. ROM was directly addressable on the bus in early PCs. They executed their ROM code directly as the access time was sufficient for low speed clocks. That is what the BIOS is. Any additional OS/BASIC environment worked the same. Later BIOS implementations had shadow RAM options to allow execution without wait states as bus speeds eclipsed ROM access times.