Without saying it, you have the right notion, it all comes down to speed and flexibility. This is directly related to the amount of runtime operations and parameters you must check against. I’m not an expert on Windows file system ACLs, but conceptually the facts remain the same.
One look at the extensibility of Windows file system ACLs and can you can see that you have a lot of different options for a wide array of attributes and security levels. Each of these options comes with a level of memory and CPU penalties. The goal is to provide a flexible, seamless permissions structure that still offers granular control. This includes capabilities on different file systems, account types and environments. It was built to serve a specific purpose, file control, which doesn’t necessarily need to operate at over 100 million events per second, like a 6509 would.
At the opposite end of the spectrum, you have network ACLs that were designed with speed in mind. When you create an ACL you not only have a hardware-optimized platform performing these comparisons, but you also have a strict set of bit-wise operations that are happening1. With standard ACLs, you only look at source and destination addresses; indiscriminate of any other TCP/IP variable.
Take the below test results from the European Advanced Network Test Center (EANTC). They stress test a 6500 with 32, 10Gb ports at 90% line rate with a packet size of 64 bytes (most stressful) from totally unique addresses and then compare it with a 10,000 line ACL that matches at the 10,001th entry. It yields a minimal drop in line rate and zero loss.
EANTC: Cisco Catalyst 6500 with Supervisor720 — 10 Gigabit Ethernet Performance Test
Although this doesn’t show latency, which would be the real testament to the speed of these platforms, they do say go on to say “Catalyst performance unaffected by the addition of value-added services such as ACLs, QoS traffic classification and NetFlow Statistics gathering.”
Once you look to add additional flexibility, such as extended ACLs, you require additional checks against the data. This adds latency. The key is that you choose which is most appropriate for the application for your business requirements. Not everyone needs an extended ACL when a standard ACL will do.
As most indicated in the comments, the amount of routines a router will need to go through every moment dwarfs a file system ACL in pretty much every way. Does this mean they’re better? Not necessarily. But they are certainly faster at what they do, just limited.
1This is assuming no logging is happening, which relies on CPU processing to log the message.