Back in the 90s, it's not as if any semi competent cs student couldn't slice your typical college server like swiss cheese. People thought null terminated strings were fine back then, and patching everything immediately was rare. So multi user was already dubious.
If memory serves, we were also still also using telnet and broadcasting passwords in the clear for almost all network services.