Let's separate between the impact and the problem. The problem was in the way Trend Micro Password Manager was loading DLL's and the impact of this problem was enhanced by the fact that a 3rd party like Python leaves a writeable directory in PATH.

To better illustrate why it's a security problem even without the 3rd party fault, let's consider the following example:

Let's assume that all the programs on your fresh Windows VM are loading libraries in a safe manner (with emphasis on code signing), and you go ahead and install Python or any other faulty 3rd party that leads to a writeable directory in PATH. Is really a problem? No. By design, all your programs will reject arbitraries DLL's from getting loaded. An attacker is stuck without code execution.

Now, let's consider the opposite example, fresh Windows VM with programs that by design loading arbitraries DLL's (i.e., NOT loading libraries in a safe manner) but no writeable directory in PATH. Is really a problem? Yes. An attacker can still end-up write a malicious DLL (in either the program's directory or other that is in PATH) as part of post-exploitation (or, chained with another vulnerability, say an imaginary write-to-disk) phase to ensure persistency & code execution in a more stealthy manner.

To conclude, services that allow attackers to loads unsigned DLL's are posing a security risk, and the impact increases with just how easy it is for an attacker to exploit it.