Why is IIS_IUSRS used instead of IUSR for file permissions?

Here is a good documentation about groups and users used in IIS 7. IUSR is built-in account for all anonymous authentication. IIS_IUSR is a built-in group has access to all the necessary file and system resources so that an account, when added to this group, can seamlessly act as an application pool identity.

You need to check if Drupal has any account specifically added in the IIS_IUSR group such that giving permission to the group suffices the need.

Going through Drupal document shows that it requires the IIS build-in group permission.

On a Windows system using IIS, right-click on sites/default/settings.php and grant Modify permissions to IIS_WPG (IIS6) or IIS_IUSRS (IIS7).