It grew out of ARPANET, a small closed network of trusted academic/military institutions, so the designers optimised for sharing — not defending against malicious users.

The internet evolved from ARPANET — a network of trusted academic and military institutions. The designers assumed:

• All users were known and trustworthy
• The network was closed and controlled
• The goal was information sharing, not protection

This resulted in protocols (HTTP, SMTP, FTP, DNS) with no built-in authentication or encryption - because in a trusted network, why would you need them?

Modern consequence: We now run these inherently insecure protocols on a global network with anonymous users and malicious actors. Security has to be bolted on (HTTPS, SMTPS, DNSSEC) rather than being fundamental to the design.

Go deeper:

• History of the Internet (Wikipedia) — how ARPANET's small, trusted network grew into the open internet, and why security was retrofitted.

Virus needs a host file, worm self-replicates over networks, trojan deceives the user into installing it.

* Virus vs worm vs trojan — a host file plus a user makes it a virus; self-spreading with no human is a worm; disguised software the user installs is a trojan. *

Tip: The key question is "does it need help?" — viruses and trojans need human action, worms don't.

Go deeper:

• Malware (Wikipedia) — the full malware family (virus, worm, trojan, ransomware, spyware) and how each spreads.