In 16-bit Windows, there were several
global shared INI files, most notably \WINDOWS\WIN.INI, that effectively operated much like registry. You can still see this reflected in the Win32 API pertaining to INI files - there's Get/SetProfileString which does
not take a filename as an argument, and then there's Get/SetPrivateProfileString which does.
Some Win16 apps would add their entries to that file - but this wasn't "badly behaved" at the time, as evidenced by the fact that e.g. SetProfileString specificaly has an argument for "app name", so the ability to do so was intentional and documented.
If I remember correctly, it was in Windows NT - where \WINDOWS became read-only for non-admins - that they started doing redirections; and even then they are done specifically for those global shared .INI files. The mappings are configurable, with configuration itself defined by registry keys - look at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\IniFileMapping to see what gets mapped where.