It doesn't need rights to overwrite system binaries, it just needs enough permissions to tickle the updater. And the updater has the rights, for obvious reasons.