Windowless controls are not magic
It seems that when people notice that the Internet Explorer rendering engine doesn’t use HWNDs for screen elements, they think that Internet Explorer is somehow “cheating” and doing something “undocumented” and has an “unfair advantage”. Nevermind that windowless controls have been around since 1996. They aren’t magic. Mind you, they’re a lot of work, but they aren’t magic. Clearly Internet Explorer cannot create a real HWND for every element in an HTML page. There is a limit of 10,000 USER handles per process, and you are likely to run out of desktop heap long before then. The Internet Explorer team went and reimplemented all of the controls that a web page would need. They have their own windowless checkbox control, a windowless listbox control, a windowless edit box, and so on. In addition to reproducing all the functionality of the windowed controls, the Internet Explorer folks also had to reproduce the “look” of the windowed controls, down to the last pixel. (Functions like DrawThemeBackground and DrawFrameControl prove extremely helpful here.) If I recall correctly, the only element that is still windowed is the <SELECT> element. If you squint, you can see some places where they didn’t quite nail it. For example, if you right-click in a text box, options like “Right to left reading order” and “Insert Unicode control character” are missing. As another example, notice that IE’s scroll bars do not light up when you hover over them.
Remember, I never worked on Internet Explorer; all I know is what I learn from people from that team. (jeffdav for example, joins the shell team for lunch nearly every day.) If you have questions about Internet Explorer, you would likely have much better success asking the Internet Explorer team yourself via their team blog.