I know loose files of the same name (pluginless replacers) always overwrite vanilla, but I'm not sure what governs which .bsa wins. File date, perhaps? Maybe it's like load order and the most recent file date wins?
I'm not sure how BSA overriding works, but I've heard others who experimented with it say it's not consistent. Some have said it's best to package replacers as separate files instead of in BSA archives because of this.