Default How does 'adb backup' get access to /data?

On my unrooted Nexus 7 2013, I can't access /data through adb shell. I get a permission error. Note, I can change to the directory (the execute bit is set), but I can't read anything from it. Also, I know from my rooted Nexus 4, that the files within each app's directory in /data/data have no other permission bits set, only the bits for the user/group of the app.

So, how does 'adb backup' access these, and can I emulate the method in the shell?