It's a single user OS that runs everything in ring zero by design. I'm not sure, definitionally, that it can have security vulnerabilities. I... guess maybe code execution on exposure to an untrusted floppy disk filesystem?

Even then, what would that accomplish in most systems? That same disk would most likely be the only permanent storage available to the system when it's inserted. Maybe if you've got two drives and have two floppies inserted at the same time?

DOS systems often had hard drives. Also, floppy virus propagation is possible (aka: Sneakernet.)

It was a different era entirely; Writing a TSR was a right of passage. Sometimes just getting something to work without having any other motive was enough to do it.

A clever and small TSR might keep a copy of itself in memory and not require two floppies in the case of no hard drive. In comparison to today’s standards, it’s amazing what we did with 640k (or less!) of ram.

My friends and I didn't have hard drives. But maybe we were just poor. But fair, you could infect another disk if you just switched disks. No need to have both connected at the same time.