A reentrancy attack happens because the EVM doesn't allow concurrency. This means that two contracts involved in a message call cannot run simultaneously.  An external call pauses the calling contract's execution and memory until the call returns, then execution proceeds normally

Yes, I think the best explanation: a smart contract can run a task at the time. The vulnerability happens when an Attacker contract calls a Victim contract creating a loop allowing to drain the funds in the smart contract