I think it could be that the platform works differently enough that you can build vulnerable Windows software by just making some assumptions that would be correct in OSX land but not in Windows. Vice versa, most probably.