That's correct - it's the same validations.
I don't believe this is the case. I think that you had a pre-existing valid authorization for the domain in the staging environment that was reused. See this thread for more information.
If you want to test this theory, create a brand new account and try the request with staging and production. I expect that if the misconfiguration that prevents prod issuance from working is still present then both environments will fail using a new account that has no preexisting valid authorizations.