Why are some systemd services in the "masked" state?

mask is a stronger version of disable. Using disable all symlinks of the specified unit file are removed. If using mask the units will be linked to /dev/null. This will be displayed if you check e.g. by systemctl status halt.service. The advantage of mask is to prevent any kind of activation, even manual.

Caution: systemctl list-unit-files is listing the state of the unit files (static, enabled, disabled, masked, indirect) and has nothing to do with the state of the service. To have a look at the services use systemctl list-units.

hostname.service is masked as redundant because systemd sets the hostname (from /etc/hostname) very early on during startup.

This setting is provided by the Debian systemd package.

$ ls -l /lib/systemd/system/hostname.service
lrwxrwxrwx 1 root root 9 Apr  8 22:47 /lib/systemd/system/hostname.service -> /dev/null
$ dpkg-query --search /lib/systemd/system/hostname.service
systemd: /lib/systemd/system/hostname.service

Similarly, Debian can now run without a shell script to halt the system, it's handled by systemd-shutdown (source code here) instead.

If a service has been masked manually, the mask will be installed in /etc/systemd/system instead.

Services are also masked when they are removed on Debian/Ubuntu. I don't know why.