They are virtual so that users can do things like 

    include pam

without accidentally writing blanks to their access.conf or limits.conf files. Basically, some mechanism to ensure that the files are only ever declared once needs to be employed. One way is to use virtual resources; another is to use (and I only endorse this within defined types) the `defined()` function; another way is to use `include`. In this case I used virtual resources.