Autoexec makes sense in historical context.

If you were a PC user in the 90s and put an application disk in your PC, you did that because you wanted to run what was on it.

You were going to run it. All autoexec did was save you some clicks.

CD burners weren't a thing in the 90s and only corporations had sufficient resources to get CDs pressed. So the logic goes that if you were big enough to make CDs then your software was legitimate.

Not to mention that pre-Internet there was basically no financial incentive to make viruses. The threat landscape was different.

But the world changed. CDs became common, malware exploded, even big companies like Sony demonstrated they were untrustworthy, and automatically running executables suddenly seemed like a terrible idea.

So yeah. I blame Microsoft for this current Windows Update malware vector because they shoukd have learned by now. But I don't blame them for Autoexec.