MS Windows will not let you delete or move or rename a file or dir that is in use ... mounted or being edited etc.
If a file is deleted in Linux, it will remove the file name from the virtual file system, so you can not access that file by name, but the inode and permissions and the list of data blocks that the file is using is a still there, still being used by the open file's id.
When the file is no longer in use, for example, when it is unmounted, the file will no longer have an open id and the inode and all the data belonging to the inode will be released.
If the operating system shuts down before the inode data is removed, the inode and data will still be in the file system, but with no file name. This is called an orphan inode, and is very common. Fsck will find and fix orphaned inodes. A journalled file system like ext3 or ext4 has the information that fsck needs, so fsck can fix orphaned inodes in a fraction of a second. Ext2 does not have a journal, so fsck needs to search through all the inodes of the file system to find any orphaned inodes, which can take hours.
By default, ext3 and ext4 do not journal data, just the metadata, so the journal is just as fast as no journal, and does not write to the file system much more than no journal, if at all.
Why umounting /dev does not break the aufs stack?
Because the /dev file is still in use, and will not be completely deleted until after the file is unmounted.
Until it is unmounted, only the file name will be deleted.
Unlike MS Windows.
PS Deleting a file is a process. First, the file name is unlinked, Then the data blocks that the file was using are released. Then the inode and the metadata in the inode are released. Each step is written in the journal, so the system knows exactly what was done and what should have been done. Which is why a journal is a good thing.
PS Fatdog "deletes" the sfs files that it copied to tmpfs, then mounted. Which deletes the file names but does not delete the actual files. So the files are still using all of the space in ram that they were using before they were "deleted". Why they do this I do not know.