The stack pointer is mixed in to the signing to act as a discriminator - it means you can't simply reuse a previously signed return pointer, you have to also have the stack frame in the same position.

As far as addition of code, you may have just been looking at the software implementation which isn't as secure as it isn't implementing an actual cryptographic signature (using a key that isn't visible from within the process)