Whay does the SQL Server Service account has the ""Impersonate a client after authentication" Right?
The documented Windows Privileges and Rights for the database engine service account are:


  
  Log on as a service (SeServiceLogonRight)
  Replace a process-level token (SeAssignPrimaryTokenPrivilege)
  Bypass traverse checking (SeChangeNotifyPrivilege)
  Adjust memory quotas for a process (SeIncreaseQuotaPrivilege)
  Permission to start SQL Writer
  Permission to read the Event Log service
  Permission to read the Remote Procedure Call service
  


The SeImpersonatePrivilege is only documented as required for the SSIS service.

That being said, I will say that the SeImpersonatePrivilege privilege is required for the database engine. Windows Authenticated client connections impersonate the client when accessing OS resources like SSPI linked servers and network shares (think db attach, backups etc).