It’s the resolver search feature for making unqualified domain names easier to use. The security problems and safe implementation advice were documented over 26 years ago https://tools.ietf.org/html/rfc1535 so Microsoft does not really have a good excuse for getting it so wrong.

This goes way back before browsers combined the address bar and the search bar. Back then when you typed a bare word into the browser, the browser would try to be helpful and add suffixes like ".com" to try to make it work.

It has nothing to do with the URL. This is lower-level resolution of hostnames. Lookup “search domains”. DHCP can hand it out as an option, it can be set with policy, etc etc

Win32 socket API doesn't do it. Python wraps it more or less directly, and:

   Python 3.8.1 (tags/v3.8.1:1b293b6, Dec 18 2019, 23:11:46) [MSC v.1916 64 bit (AMD64)] on win32
   Type "help", "copyright", "credits" or "license" for more information.
   >>> import socket
   >>> socket.gethostbyname("example")
   Traceback (most recent call last):
     File "<stdin>", line 1, in <module>
   socket.gaierror: [Errno 11001] getaddrinfo failed
   >>> socket.gethostbyname("example.com")
   '93.184.216.34'

mh, can't reproduce on Windows 10 and Firefox 73 get a "Server not found" page as expected

It's application dependent behavior, AFAIK. Windows internals / APIs add .com by default, I believe. You probably hate this behavior like I do, and at some point in the past set "browser.fixup.alternate.enabled" to false in Firefox's about:config.

Win 10 and Firefox 72.0.2 here.

New Private Window -> http://example -> http://www.example.com/

It's never been the browser sticking index.html on the end, that's 100% the server since time eternal.