How can CAN transceivers ouput CANH=3.5V and CANL=1.5V?
A properly sized MOSFET can provide extremely low voltage drops, at the expense of increased die size. For instance, power MOSFETs routinely provide on resistances in the milliohm range. Of course, this is at currents of 10s of amps. For CANBus, the currents involved are far less, so the FETs don't need to be as large. But let's say the FET is sized for 0.1 volt drop at the desired current. Then the total drop within the driver will be about 1.2 volts (2 x 0.1 plus 2 x 0.5), leaving 3.8 with a 5 volt supply. This is comfortably greater than the minimum requirement of 3.5.

And yes, there is process variation between chips, so the actual voltage across the termination resistor(s) will vary a bit. But, of course, that's the beauty of digital - as long as the voltages are within tolerance nobody cares about the details.

EDIT - And the 1.5 limit represents the sum total of all of the leakage currents through the MOSFETs which have been turned off. Since there can theoretically be on the order of 127 such units, even small leakage currents could add up.