What is it writing and changing in my sys32 folder via cmd?

Diablo originally created it's multiplayer save games here to make it harder for cheaters to manipulate them.
In the latest version it was changed to write them in the same folder as the exe, but it will still check for old saves so that they can be converted to the new place and format.
Note that Hellfire is based on an older version of the game and will still write to the system32 folder.

There are several other security related issues with the original client. I help maintain a port to modern systems called DevilutionX that updates the game to work with modern security standards so you could give that a look if you prefer it not to have admin access etc.

I guess OP refer to install process. And he miss something: CMD do nothing in system32 except that fact - it is stored in system32.
Install process install sdb package with some compatibility presets (made by Ms App Compatibility Toolkit) and few else silent set-ups (incl OS redists) by DISMM service started from CMD. system32-CMD mean CMD started with adminrights. It is how CMD work. Without admin rights instead of sys32 it will show >user:/ in console and User:CMD in window tab title.

sdb packages compatibility overwrite notmal app compatibility sections in REGEDIT but also copy that into additional registry dirs in same sections and will copy sdb file to Windows subfolders. This is how they installed including directly by Ms ACT if you have such tool installed.
Did they needed there? Probably not.

Normally that sdb should appear as app installed in Uninstall programs list. Sometimes that wont happen from GOG or ZOOM installers (and they update to fix that). So it can be uninstall without using Ms ACT if you want remove this compatibilities presets. In Ms ACT there is own list of installed sdb's where they can and should be uninstalled. For non-ACT users and installs ,they normally should add entry to unistall list (in win registry).