In cpanel, an add-on domain is really a subdomain of the account's domain. The add-on domain name is merely an alias for the subdomain with a subdomain's directory structure (a subfolder of the main site). There is no separate cpanel for each add-on domain, they are all managed in parent site's cpanel (they are subdomains afterall) . You can create mail for the add-on domains, but cpanel makes no real distinction between add-on domains and the account domain.
Thus if you create an addon domain in folder /domain2
Main domain - domain1.com
Addon domin - domain2.com
Cpanel creates subdomain domain2.domain1.com
domain2.com points to domain2.domain1.com
A valid and working url for domain2's site - http://domain1.com/domain2
Its obvious now that there is no technical difference between subdomains or add-on domains
Add-on domains in cpanel presents a security issue because the the first site's ftp account can access all the add-on domain's sites (there are tweaks to get around that, one needs whm or server access). In that sense Windows with all the panels I know of creates s more secure environment because an add-on domain has separate directory structure and panel as if it were just the only domain.