It has preemptive multitasking for compute-only tasks (the MultiProcessing library. See http://mirror.informatimago.com/next/developer.apple.com/tec...)

I also think the OS, technically, was preemptive multitasking, but ran all ‘normal’ code in a single preemptive task (https://groups.google.com/g/comp.sys.mac.programmer.help/c/f...)

I also vaguely remember the kernel had some memory protection enabled.

Of course, almost none of that mattered for typical user-space programs.

Mac OS 9 has virtual memory (it uses virtual address translation and it can swap pages to disk), but it still has a single address space that is shared between every application.

Ah. I remember reading "it has virtual memory" and assumed that this includes each process running in its own address space.

Was it common for applications to reach directly into kernel memory instead of using proper APIs?

This is an issue for SheepShaver (limited to 9.0.4 because 9.1 and up require the MMU as you say), but not QEMU, which emulates the MMU and thus runs 9.2 just fine.

No, after 8.6 the system featured a micro kernel on which the old OS ran atop. I think you could opt in for better stability, but I'm not sure. But most of the OS and apps still ran on the same shared memory space with cooperative multitasking, meaning a single app could (and did) bring the whole system down.

I think you can emulate 9.2 just fine, but it's been a while since I played with this things.