It's the central bureaucratic/theocratic function of a major world religion which, it just so happens, is organized as a micronation instead of as a foundation or something like that. The primary function of the UK is not to run the Anglican church, nor is their king generally thought of as their primary leader.

Interestingly, legally, the Holy See and the Vatican City State are not the same thing.

The one which is the global seat of the Roman Catholic Church, which has existed since ancient times including for a time without any territory after the Papal States were lost, which is internationally sovereign, and the one to which ambassadors to the "Vatican" are accredited is the Holy See, not the Vatican City State.

The one that has .va is Vatican City State, which was created only in 1929 by the Lateran Treaty between the Holy See and the (then-)Kingdom of Italy. That treaty was signed to return a certain degree of independent territorial authority to the Holy See, including the Vatican City State where it has full sovereignty, to give financial compensation to the Church / the Holy See for the loss of the Papal States, and to address a few other matters.

Yes, the Vatican City State is under the governance of the Holy See as a sovereign entity, but it's the Holy See that's sovereign, not the Vatican City State - and the Holy See would remain legally intact if the Vatican City State were to be physically conquered by a foreign power.

ISO country codes which lead to ccTLD domain names like .va are often given more on the basis of internationally recognized/relevant territorial definition than on the basis of international recognized/relevant sovereignty where those two things diverge. After all, the British Indian Ocean Territory has never itself been sovereign under that name, and Taiwan's international sovereignty is a controversial question, but .io and .tw ccTLDs were still assigned and are universally recognized. it's for the same reason that .va goes with the territory and not with the global church.