The source code for Superuser is available on github, the main author of Superuser are Adam Shanks (ChainsDD) and Koushik Dutta (koush, also author of Clockwork Recovery).
Koushik Dutta explained in his blog how Superuser.apk works; note that the post is from the very earliest incarnation of the Superuser app, a lot of things have changed since then and some of what was written there are no longer correct for modern superuser/su implementation, but the basics should still be the same.
Both su and Superuser can certainly be replaced by alternatives, but it wouldn't really do much as the facility that su uses (i.e. exec() and setuid() system calls) is available to any executables, given that the executable had the proper permission bits (i.e. setuid bit is set to root). At the core, su is a very simple program, it just spawns a process as another user; the real security check is done by the kernel.
So, as long as you're getting the official, unmodified su and superuser app and they're installed properly with proper permission, you don't have anything to worry about, they're open source and safe, you can verify the source code yourself at github. However, it is certainly possible to get a trojaned superuser/su binary, so make sure that wherever you're getting your superuser/su binary is trustworthy (or compile su/superuser yourself if you're truly paranoid).