windows xp was so insecure that when it was first released, you could punch in anyones ip address who was running it into any web browser and provided they didnt have a firewall (which a lot of people didnt back then) you would get access to their hard drives through your browser.
Thats simply not true, to access anybodys folders on XP you would have needed there user account and password, exactly the same as windows 2000.
If you were on about windows 95/98/me, then your correct, simply putting there ip address in, would give you access to all shared folders on there computer (unless they passworded them or hid them using the $ sign).