So instead it has a buffer large enough to hold all the types? That’s what union does.
Still waiting to hear the security concerns.
Actually, it does use a union, in both libstdc++ [0] and libc++ [1]. (Underneath a lengthy stack of base classes, since it wouldn't be C++ if it weren't painful to match the specified semantics.)