To add a more technical explanation, the main point is about the expectation on how it behaves and not what it really does. To get windows to do something, you read the specification (interface) and make a call against it. Windows interprets your request and does what you wanted. You do not care how it works but just that it works. As a developer, you can also switch to the other side and make your own program that interprets these calls and translates, them for linux.
Legally (I am not a lawyer), the specification is a fair game. The spicy part is how it is done and copying that gets you in trouble.
Of course, this is also extremely simplified since linux and windows differ wildly in many regards. Also a “specification” is often incomplete or the implementaion bleeds into the real world use. This makes it not reliable to look at it alone and so, often the “original” implementation has to be observed on how it behaves.
As a more relatable example, think about websites. On the one hand, it does not matter which browser you use. It “just” has to display the page and act accordingly. On the other side, it does not matter what server sends you the page. It could be a pre-computed static page, served via a proxy server or dynamically generated by any of the different programming languages.
Edit: grammar
My EU bank never ever used my phone number to verify anything. They only used it to contact me on some occasions. 2FA is done through their app.