how service sid operate under the covers?
Service SIDs aren't a SQL Server thing. It's a technic inside windows to isolate different services from another. In the basic example where sql server is using NetworkService as account, many other services could have access to the SQL Server or its files.

Service SIDs and domain accounts have another importang aspect: if you change the domain account, all ACL secured objects are still valid and don't have to be updated.

See also http://support.microsoft.com/kb/2620201