re:
!> is app_data a reserved name for IIS and ASP.Net

No, it's not.

The files which are not served are set in the master web.config file, in the
<httpHandlers> section, managed by System.Web.HttpForbiddenHandler.

That m,aster web.config file is located at :
drive:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config

Examples :

<add path="*.mdb" verb="*" type="System.Web.HttpForbiddenHandler" validate="True" />
<add path="*.ldb" verb="*" type="System.Web.HttpForbiddenHandler"  validate="True" />
<add path="*.mdf" verb="*" type="System.Web.HttpForbiddenHandler" validate="True" />
<add path="*.ldf" verb="*" type="System.Web.HttpForbiddenHandler" validate="True" />

You can add any other file extensions you don't want
ASP.NET to serve directly by following that format.

re:
!> is there some jiggery pokery going on behind the scenes with file permissions or virtual roots?

There's also some jiggery pokery going on behind the scenes with file permissions or virtual roots.

If you create a Web site in Visual Web Developer (whether the standalone or the VS IDE),
VWD creates a folder named App_Data below the current root folder.

The folder is designed to be a store for application data of any type.

The App_Data folder is also used by ASP.NET to store databases that the system maintains,
such as the database for membership and roles.

When VWD creates the App_Data folder, it grants Read and Write permissions
for the folder to the ASPNET or NETWORK SERVICE user account.

So, if a request is made from an external browser for a forbidden file,
the account requesting it won't be the ASPNET or NETWORK SERVICE accounts,
which are the only ones which are allowed access to those files.

There's no "unexplained magic" involved.
It's all pretty much straightforward.

Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
======================================