since the result of storing items in ViewState is that those are stored in string on page (to maintain state between multiple requests), they need to be serializable, on the other hand Session is in memory storage (if you're using InProc mode, which is default, otherwise this doesn't apply), so objects don't need to be serializable.
Additionally see this answer for clarification: Why Viewstate can contain only serializable object?
Hope this helps.