Why can members of db_datareader SELECT sys views
Metadata visibility configuration doesn't work in the same was as permissions for User tables - the rights are included implicitly whenever rights to underlying objects are granted.

Take the following example from the docs:

SELECT name, object_id  
FROM sys.tables  
WHERE name = 'myTable';  
GO  


The above returns no results for users that have been granted no rights on those underlying tables. It therefore follows that if you grant db_datareader (IE SELECT on all tables / views), you're also implicitly granting access to sys.tables for all Tables / Views in that database.

This is true for all GRANT states (IE DENY won't cause the user to see metadata for related objects, but GRANT will)

In summary, granting access to a user object also grants access to the metadata for that object, exposed via the system catalog.