The appliance is Windows based, it has a lot of Windows services turned off though to make it more secure than a standard Windows build. The appliance was basically designed so that you could lock it away in a closet and the only access is via the web GUI, rather than what most people end up having with their ACS server sitting on a spare desk with open access to the screen and keyboard. As I said initially, it also runs a more secure version of standard Windows so that it shouldn't be susceptible to all the worms/viruses floating around nowadays.
So, it is Windows based, but it isn't part of any windows domain, so if you want to authenticate your users based on their Windows username/password, the appliance has to hand that username/password off to a PDC/BDC, which is why you need the agent running on that separate machine. It is a little extra work, but once set up shouldn't ever need changing, and it is only necessary when doing Windows-based authentication specifically. For other external databases, the appliance can talk directly to them just like a standard ACS server can.
