But they do load from the working directory by default [0] and until XP SP2 they put it before system32 in the search order [1] by default.

[0] https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic...

[1] https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic...