Actually, there's an interesting question - how does Wine implement (or not implement) Windows API calls which interact with filesystem features which aren't available on Linux, like alternate data streams or complex ACLs?
From a quick search, it sounds like ACL metadata is stored in a way that's specific to NTFS. Given that Wine prefixes don't tend to have their own partitions, I'm guessing that if Wine supports them, they just store the info in a config file (similar to how the registry is implemented via text files stored in the root of the prefix) and then looks up accesses from there.
Wine probably isn't something you'd want to use if you're concerned about actually enforcing full Windows security rules. Even if you were able to enforce access to files when executing within Wine itself, the wine prefix will still usually just be a bunch of 644-permissioned files sitting on a Linux filesystem that can get used like any other; the entire wine prefix is just a regular directory with regular files from the external perspective of the wider system, and nothing stops anyone from doing whatever they want that they could do to any other file with the same permissions.
