The early Macs were basically wide open, as I recall.
I was working in a group next to the systems software group at Apple when some of the early malware was discovered. After a few days of secrecy, with people being pulled into labs and conference rooms under spooky circumstances, the software managers sent out word that some malware had been found and that people were working on mitigations. They also said something like "Look guys, we know that writing malware is really easy, so don't do it, because we'll fire you immediately if we find out." I distinctly recall that this was in verbal instruction, not a memo, and that the words "really easy" and "really, don't do it" were used.
Naturally my response was to go back to my desk and write a proof of concept. Half an hour and a hundred lines of code later I had something that would replicate a payload whenever you inserted a floppy disk. It was indeed dead easy to do. I exercised my toy for a little while . . . then deleted every trace. I'm sure I wasn't the only engineer who was curious and did this.
So while you couldn't change the ROM, you could definitely muck with the system software, and that's all that really mattered. Zero thought had been given to MacOS security.