Comment by rbanffy

You’d need to touch many different parts of the OS to write those extensions. The difference is that, on MacOS classic, there isn’t much of a boundary between user space and kernel space.

I’ve done a couple MITM toys with Windows 3.x and the trick is always exposing the same interface as the thing you want to replace, even if you only do something like inverting mouse movements on odd minutes, you just pass everything else down to the original module.