How does Abstract Factory make it structurally impossible to end up with a mismatched pair of related objects?

Each concrete factory, like WindowsFactory, only ever references its own family's concrete classes inside its own source code — its createScrollBar() method returns a WindowsScrollBar, and the MacScrollBar class is not mentioned anywhere inside it at all. Because client code receives one factory instance and asks that same instance for every product it needs, there is no code path available that could construct a button from one factory and a scroll bar from a different, mismatched one. The guarantee is not a coding convention someone has to remember to follow — it is a direct consequence of which concrete factory class the client happens to be holding a reference to.