Historically, there was an API translation layer that VST2 plugins used (called Symbiosis), but these days the vast majority of plugin devs use a framework like JUCE which has multiple different "client-side" API implementations (of VST2, and VST3, and etc) that all wrap around JUCE's native class hierarchy.
There's a few other frameworks floating around (Dplug for writing in D, a few others in C++), but JUCE is far and away the most common.
Someone else said
> Almost all VST plugins have an AU version (like 80%-90% or so, and 99% of the major ones).
Which I noticed as well, I wondered if that required a large time investment to support both or there's some API translation layers available.