For s you're matching the constructor that accepts an initialiser-list of characters: that's (9) in the list here. The string class lets you construct strings from arbitrary data which may include embedded NULs, as it does in this case. The initialiser list knows its own length, so the string captures all the characters.
For s1, the matching constructor is (5) in the above-linked list, which accepts a const char* - the compiler lets the array of char provided decay to such a pointer before calling that constructor, which means the constructor has no knowledge of the length of the array. Instead, it assumes you're deliberately using the ASCIIZ NUL-terminated string convention (as in "C" strings), and scans through the data to find the first NUL, considering that the terminator. Consequently, only 2 characters are captured in the string.
Note that you can explicitly capture 4 characters with...
std::string s1 { "ab\0c", 4};
...which matches constructor (4) in the list.
Rakete1111's comment below illustrates another, newer way to create such strings: auto s1 = "ab\0c"s;.
endlunless you specifically need to have the buffers flushed. Just use"\n"instead. When writing to a terminal console it will usually be line buffered anyway and when writing to some other pipe you do not incur the unnecessary overhead of flushing your buffers every time.