Programmatically speaking, how is Android set to be "unrooted" by default?
This isn't a special extraterrestrial thing. 


The default user doesn't have root privilege.
All those binaries are removed which can grant root access to default user.
/system partition (which contains sensitive files) is mounted as read-only. As only root user can remount a partition with R/W access, you're out of luck modifying those files..