For the record, $ is defined to match "before a newline at the end of
the string, or at the end of the string" in normal mode, and "before any
newline, or at the end of the string" in multiline mode.

(and I have a vague memory that the "before a newline" behaviour in
normal mode was added for Perl compatibility)

> It seems that it matches BOTH the end of the string AND just before
the newline at the end of the string.

Of course it does: re.sub scans the string for matches from left to
right, and does the substitution everywhere the pattern matches, only
skipping over the matched parts.  Or in other words, if a pattern
matches N characters on position X has no influence on whether it
matches on position X+N or not.