How can a firewall that should control traffic on Layer 3 be short-circuited on Layer 2, and why does this happen in real organisations?

If the two subnets are also connected directly on Layer 2 (for example a switch or VLAN link that bridges them), traffic flows past the firewall and its rules never apply. It happens through division of labour: cablers work up to Layer 2, another department configures Layer 3, a third runs the firewalls, and without enough communication their setups contradict each other.

At first glance nobody would build this on purpose. But each team's work can look correct on its own: the network team links two switches for redundancy or convenience, the routing team configures subnets, the firewall team writes good rules. Only together do they produce a bypass. The lesson for the architect is that a perimeter is only as strong as the agreement across all the layers it depends on, so the design must be reviewed across team boundaries, not only per device.