I found windows confusing. In Linux speak, was this some kind of kernel module thing that CS installed? It’s all I can think of for why the machines BSOD
They could have named their files "foo.cfg", "foo.dat", "foo.bla" and been equally protected.
The use of ".sys" here is probably related to the fact it is used by their system driver. I don't think anybody was trying to pretend the files there are system drivers themselves, and a quick look at the exports/disassembly would make that apparent anyway.