If that's the programming style that was deemed acceptable for release, I can almost guarantee you that the old, unmaintained client will definitely have some other vulnerabilities left over in its protocol.
[1]: https://www.geoffchappell.com/notes/security/aim/index.htm
Initially AOL's was done (GUI and non-GUI functionality) via their client API called FDO and sent assembled packets out like everything else. AIM on the other hand was a classic simple GUI app using a different protocol and used none of AOL's FDO stuff.
Much later AOL used some OSCAR (AIM) libraries to piggy back the AOL client on-to AIM for buddies and IMs, but even so these were not a part of the exploits that kept popping up for AIM, and long after AIM's drop in popularity as well.