One example would be a buffer overflow attack. These are often very specifically targeted against specific versions of application software. If you had an exploit that worked against IIS 7.0, that same exploit would not also work on Apache.
A counter-example would be a cross-site scripting attack, which only attacks the client's browser, and is agnostic to the internal applications.
With a homogenous ecosystem, a virus that can infect one vulnerable system can easily spread to infect all identical systems, or an exploit that can be run one one machine can be scripted to run on many.
Diversity provides redundancies, and they can help limit your damage. If you have two brands of gas pumps in your store and a virus starts stealing credit cards, it may only steal half of your customer's cards.
The drawback to diversity is if it presents two attack surfaces for an attacker to choose from. The gas pump example above is one such scenario. As an attacker, I can try attacking the easier of the two pump softwares, and if I breach either, I get to steal half your credit cards. As a thief, stealing half your gold is still a lot of gold, and is worth it.
EDIT
Diversity is now less valuable than this paper suggests. As security practices have dramatically improved since 2003, threats have become increasingly sophisticated as well. The paper concerns itself only with "dumb" attack vectors such as viruses, which were a bane a decade ago, but thanks to improved security are now far less successful than they were then.
Modern threats are targeted and tailored to the victim system. They identify the software through fingerprinting methods, then craft an attack designed to defeat it. Tools like autopwn mean that a diverse environment simply provides extra chances for a system to be vulnerable.
Diversity takes advantage only of security through obscurity. A diverse system might be considered safe only because so few of them exist that an attacker has never bothered to explore it fully to find its weaknesses, or that the target is of such low value that there was no reason to attack it. Advances in botnet technology mean that even ultra-low-value targets like refrigerators or thermostats can deliver value to an attacker either through spamming activities, or perhaps as a target for ransomware, so they're becoming increasingly studied by attackers for vulnerabilities. That means that a thermostat's cloud service on your home network may end up being the entrypoint for an attacker to get behind your firewall, where he can attack your banking PC at his leisure. In this case, diversity unwittingly enables the attacker.
Up until not too long ago, I had thought diversity was a good strategy. After watching attackers ply their trade, I am now convinced that it's almost irrelevant, and that effective security practices need to remain the primary focus of security teams. Simplifying systems, reducing their attack surfaces, application reviews and security analyses, separation of duties, isolation of credentials, key and certificate management, and clear security policies, those are the effective practices.
