It was possible (see the infamous "
1 RETURN bug") because the
RETURN operand used to stop the execution of the Script. So simply pushing
1 in the scriptSig and
RETURNing would make the execution of the catenated
scriptSig || scriptPubKey successful no matter the content of the scriptPubKey.
Separating both certainly makes it easier to reason about and therefore be certain it's safe from this failure mode.
I initially posted this answer with an assertion that once the
RETURN operand was fixed it was unclear how you would bypass the scriptPubKey. I didn't think hard enough! Actually you could simply include a
PUSHDATA, which would interpret the scriptPubKey as a data array pushed on the stack, which would then make the execution successful since it would be casted to
true as long as it's not all
So it's true that catenating the scriptSig and the scriptPubKey is always unsafe.