There’s a system behind it, which the same one that underlies all of “Full keyboard access” (which is of by default because it takes a bit of background information to master). When you press space, the item under the focus ring is selected; not only this, you can shift focus to other elements by pressing tab. So the ring acts as a visual indication of the item you will select. The filled-in blue button is there regardless of whether “Full keyboard access” is enabled and is intended for a sensible default so that pressing enter will do something useful. The “Cancel” action is usually mapped to escape. The focus ring, then, is usually set to the third option if there is any because that one wouldn’t be accessible via a keyboard key otherwise.
I know the reason for it! But the fact remains that it's two actions that are superficially the same (press an affirmative sort of key to trigger a highlighted button), and users who choose wrong lose data. That's... pretty much a one-sentence definition of bad UX :D
The same system would make perfect sense if it only had one focus target. Dialog comes up, the "main" action is focused, tab cycles the focus, space/enter select it, and escape cancels the dialog. There'd be nothing to learn and nothing to remember.
