Because that’s how Zwave is designed to work. Seriously, it’s not any more complicated than that. It doesn’t respond to just any message, only to properly encoded “basic“ messages.
Think of it this way. Device three doesn’t know anything about device two. It doesn’t care about device two. It cares about receiving properly encoded instructions from the network that it belongs to.
What direct association does is let the controller approve device two sending those properly encoded network messages directly to device three without going through the hub each time. Only a basic command and only to the specific targets that were approved when the association was set up.
When device three gets the message, it literally doesn’t know whether it’s coming from the hub or from device two. It just knows that it’s a properly encoded message from its network with the correct security keys. The fact that it came from device two instead of from the hub is transparent to device three, even more so because of the nature of a mesh network where the message may have come through a repeater anyway.
Lifeline Group wasn’t enforced with older Z wave Devices
Also, “lifeline group“ was just a convenience in older devices. It wasn’t enforced. There were some devices, like Fibaro, that used association group one for direct association and association group two for messages to the hub. So if you have an older device that lets you put other devices into group one, it’s just group one. It’s not technically the “lifeline group” until it is restricted to just the hub. So if your devices only have one association group but they are allowed to use that for direct association to anything other than the hub, the manufacturer may call it the lifeline group, but it isn’t really.