You do realize that that was the big problem with IE security in those days: ActiveX. You literally could embed an Excel file in your HTML page.

You could embed any native code and it would just be a small yes/no dialog to download and run it.