The difference is that there's an underlying assumption that base reality is analog and perhaps continuous rather than discrete, and definitely not CPU or memory constrained.

In the scenario you mention, reality would be a program because it is still run on a computer in either case. If reality isn't a simulation, then we shouldn't be able to DDOS it, or overflow it, crash it, access a memory buffer, get root access, or execute timing attacks as those things are artifacts of computation.