It wasnt sandboxed from the DOM, it has enablehtml access and later on tacked on cross domain protections. They did apply a sandbox to the filesystem unless you trusted it.

There was no fine RBAC or anything. https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-049

Java applets were pretty bad too. Flash and the old quicktime or realplayer were a legitimate need in early days before the standards bodies started moving. Silverlight seemed to be an attempt to stall the standards moving forward.

I get that some people liked it, but better options were already available, and could run on all devices with regular security updates.