Sort of. Blizzard goes to great lengths to keep players from running "bots". For example, a bot might allow a player to run an account 24/7 that would just kill a specific monster over and over until a certain rare and valuable item dropped. This isn't possible, because certain actions (such as "Attack the monster") can only be taken in a script that is running in response to a UI event. This isn't a security fix though, just a way to prevent players from gaining an unfair advantage by running bots.

On the other hand, I did write a handy few handy little addons despite this restriction. For example, when you're doing lots of wheeling and dealing at the auction house (a perfectly legitimate way to make in game money), you tend to receive a huge amount of "mail". When another player buys an item you're selling, you receive the payment via your mailbox. It can be tedious to go through all the messages and take the money or items (mostly a UX issue if you ask me). To get around this, I just added a "take all AH stuff" button to the mailbox UI. There were a few problems, in particular that you'd have to "pump" it, because moving to the "next page" of mailbox items was an asynchronous operation, and the callback wouldn't be able to do the "take item" action.

Users contribute huge numbers of useful addons despite this restriction - for example, auction house addons can remember price data and show you items that are substantially above or below their general market value. The famous "Carbonite" addon made gigantic improvements to the in-game map, most of which were later incorporated into the default interface. And no serious raider would go into battle without a host of combat helpers, DPS meters, and so forth.