Members of the a SharePoint group always receives the permissions attached via the Permission Level (changeable at Site Collection or via SP-CA). Site Owners have the highest permissions level (Full Control) on that particular Sub-Site. Only members of this group or the Site Collection administrator(-s) get to change permissions on that site (and sub-sites if those are not created with unique permissions).
The person creating the site with Unique permissions gets added automatically as member, this is also to avoid situations when Site Owners are fiddling with permissions and find themselves locked-out (it happens quite often too). This is where Site Collection administrator could reset the whole situation - that is why whatever you try to do Site Collection Administrator cannot be removed from any permissions (you find it nowhere either).
One additional situation is when via Central Administration - Policy (i believe) someone is given Full Control over the whole Web Application - this gets full permissions across all Site Collections without anyone being able to remove it (other than via SP-CA) and is not actually added to the groups neither.
Default site creation process relies on Security Inheritance, which gets pushed down from parent Web, and if nothing is changed, from the Top Level site.
Hope this gives more insight into the process!