I think it doesn't have to be the 403 page that Apache would have sent, it may just be one you made yourself, and which somewhat looks like a 403 error page.

Besides, as error pages can always be customized, there's no need for it to ever be the real 403 page.