TL;DR : Sam bleeds because it's how his body would react when his skin is cut, so the simulation of his digitized body reacts the same way. Programs don't bleed because they are made of pure code, not a simulation of a physical body.
The presence of Sam in the virtual world is not the same as in other virtual worlds. He is not "Jacked-In" like in the Matrix, he is completely Digitized, all his molecules are transformed into code.
Thus, if it's not real Sam that controls his simulation of himself from outside, it's a full and complete simulation of Sam that run, including his brain, all organs and of course, his blood.
If you ask how a 80's computer could run a full and complete simulation of a human being, well, it's just a movie! But the Grid seems to have done some simplifications, of adaptations to how it works. Users sometime react like a normal programs (the need of a disk, circuitry in the original Tron, etc.), but sometimes like humans (blood among others). It's like the simulation of a user works like a human locally, but like a program globally. The separation between those is more an artistic decision than a rationalized deductions.
As for programs, they don't bleed because nothing in their code says they need to bleed; they are built out of pure code. In Tron Legacy, when a program is hurt, the wounded part shatters into small cubes, a representation of the bits their code is built out of, literally their building blocks: