How do iphone backup extraction programs work?
The apps usually just initiate a backup themselves first, having their own implementation of the iOS backup protocol (or using libimobiledevice libraries). So, they're not really directly accessing the iOS filesystem via USB, they're making a backup in their own app data folder, and then accessing that. (I work on iOS backup tools - not the ones you mentioned - and this slight of hand from other tools bugs me ;))


  How can any user extract a backup file from a usb-connected iphone?


Are you asking about how to get to one of the files in your backup, or how to download the files from the iPhone (aka acting like a backup client)? If you want to take your own backups without iTunes, libimobiledevice is your best bet. https://github.com/libimobiledevice/libimobiledevice