That is right and by design.
NT SERVICE\MSSQLSERVER actually is the AD account you assign to run the service.
So it is saying find the service account used for the service MSSQLSERVER from services.msc and pass that account for authentication/permission control.
This is so you can change the service account in SQL Configuration Manager and not have to go and change it in multiple locations.
The same is true for NT SERVICE\SQLSERVERAGENT, you will see that the actual service accounts don’t get a direct mapping at the instance level also, they are there as the NT SERVICE principals to again ensure you can change the actual accounts in the manager and everything just works.