TL;DR : Sam bleed because it's how is body would react when his skin is cut, so the simulation of his digitized body react the same way. Program don't bleed because they are made of pure code, not a simulation of a physical body.
The presence of Sam in the virtual world is not the same as for others victuals words, he is not "Jacked-In" like in the Matrix, he is completely Digitized, all his molecules are transformed into code.
Thus, if it's not real Sam that control his simulation of himself from outside, it's a full and complete simulation of Sam that run, including his brain, all organs and of course, his blood.
If you ask how a 80's computer could run a full and complete simulation of a human being, well, it's just a movie! But the Grid seam to have done some simplifications, of adaptations to how it works. User sometime react like a normal program (the need of a disk, circuitry in the original Tron, etc), but sometime like humans (blood among others). It's like the simulation of a user works like a human locally, but like a program globally. The separation between those is more an artistic decision than a rationalized deductions.
As for program, they don't bleed because nothing in theirs code say they need to bleed; they are build of pure code. In Tron Legacy, when a program is hurt, the wounded part shatter into smalls cubes, an representation of the bit theirs code is build of, literally theirs building blocks :