How can a firewall that should control traffic on Layer 3 be short-circuited on Layer 2, and why does this happen in real organisations?

If the two subnets are also connected directly on Layer 2 (for example a switch or VLAN link that bridges them), traffic flows past the firewall and its rules never apply. It happens through division of labour: cablers work up to Layer 2, another department configures Layer 3, a third runs the firewalls, and without enough communication their setups contradict each other.

* A Layer 2 link between the subnets lets traffic flow past the firewall, usually because different teams own different layers. *

At first glance nobody would build this on purpose. But each team's work can look correct on its own: the network team links two switches for redundancy or convenience, the routing team configures subnets, the firewall team writes good rules. Only together do they produce a bypass. The lesson for the architect is that a perimeter is only as strong as the agreement across all the layers it depends on, so the design must be reviewed across team boundaries, not only per device.

Go deeper:

• MITRE ATT&CK T1599 — Network Boundary Bridging — how attackers who control a network device remove the boundary it enforces.
• VLAN — Wikipedia — how one switch is split into separate broadcast domains.