I am not an expert, just remembering what I saw. I tinker with it a little (and am writing this in a Haiku OS VM, through Falkon.)
There is a daemon running when I call `ps` that I see is called package_daemon. I think it is this one: I think it has exclusive access to a set of directories where software and such is installed. There is no sudo, su, etc. because you don't need it. hpkg files are loaded by the package daemon into the correct paths.
I looked at this a few months ago just to get what it is doing. It has to have some security model that protects certain paths at least. This looked like it.