They share a lot of "AMFI" infrastructure between iOS and macOS, with macOS having a much more permissive security model (you can run self-signed code) while still retaining "private" entitlements for sensitive private APIs, only available to Apple-signed apps. Unless you disable SIP, then you can just do whatever.

(Disclaimer: I may be wrong, I haven't done much of my own research, it's just things I read in various articles over the years)