In theory:
VST provides a (cross-platform) library (libvstgui) that is used
to draw pixmap GUIs. The plugin code calls UI functions.
In practice:
Many plugins call OS specific drawing functions.
I'm not sure how automation is handled, but I dont think UI controls are
routed via the host, so I'm guess its done on "trust" and fudged timing.
the plugin is supposed to make a callback to the host
("setParameterAutomated") to tell the host about the change in the
parameter value.