https://cloud.google.com/vpc/docs/firewalls#rule_assignment
The priority of the second rule determines whether TCP traffic to port 80 is allowed for the webserver targets:
If the priority of the second rule is set to a number greater than 1000, it has a lower priority, so the first rule denying all traffic applies.
If the priority of the second rule is set to 1000, the two rules have identical priorities, so the first rule denying all traffic applies.
If the priority of the second rule is set to a number less than 1000, it has a higher priority, thus allowing traffic on TCP 80 for the webserver targets. Absent other rules, the first rule would still deny other types of traffic to the webserver targets, and it would also deny all traffic, including TCP 80, to instances without the webserver tag.