It is because like buttpns can be iframed, they are just a plugin you can put on your personal site.
Most every page that is rendered on facebook.com cannot be iframed, they have used different types of framebreaker coding and they adapt it often, so it is nearly impossible to iframe any page internal to facebook. I have had an exploit to "allow-jack" before but it got patched very quickly and there are other security implementations to prevent unnecessary apps from going viral anyways.