How does SQL Server handle logins when the user is a part of multiple groups with various privileges?
For normal roles, permissions for all role memberships are cumulative and DENY takes precedence over GRANT.  However, sysadmin is a special case.  SQL Server permissions are not checked for sysadmin role members so members of that role have full permissions to all databases on the instance.