Because they’re not really “composite files”, they’re packages. It’s just a normal directory with a bit set to treat it as a file in context (also driven by file extension). “Show Package Contents” just opens a Finder window rooted within the package. From CLI you’ll see them as a directory.
Aha. Feeling dumb that I didn't know that. Of course they're directories with some metadata. Duh.
I always kinda guessed that DMGs were something like a ZIP file. Well, not really:
"3. Mounting DMGs
DMGs can be mounted, just like any other file system, though technically this is what is known as a "loopback" mount (i.e. a mount backed by a local file, rather than a device file)"
