It makes me wonder, is it possible to write something this complex in assembly today, given modern security features.

Not that you'd want to, given that OpenTTD has networked features and you'd want something that makes it easy to validate/isolate remote payloads.