There are many reasons for that, not just one. One of the things we do is that the resource-intensive code emulation is done once and the result is cached for future use so advanced heuristics doesn't have to emulate files each time they are accesses and scanned. Then there are other safe caching mechanisms to ensure that files are re-scanned only when needed (e.g. after module updates), trusted / whitelisted files are scanned less frequently, etc. which also positively affects performance.
Alex21 received kudos from WhiteLTG in Eset 12.2.29.9 Issue
