Comment by sitharus

On modern macOS applications can flag an input field as secure, which blocks keypress interception. The permission is fairly new, but the actual feature has always been there as part of the window server. I used it back in the 10.4 days to implement macro recording.

Classic Mac OS extensions on the other hand had free rein to modify any part of the kernel. They really could modify anything.