How do Acls work on folders

This has nothing to do with folder security, which is a different topic altogether.

A permission set, or ACL, on a folder, controls whether that folder is displayed in the Desktop and Intranet clients. It has nothing to do with whether a user can make changes to the documents within the folder. This is determined by the ACLs assigned to each document. Folders are visible to all users with BROWSE permission. A user with NONE cannot see a folder from their client. A folder does not protect documents inside. Users with access to those documents can still search for, find, and change those documents