I have 2 devices both 500 Series ZWave.
They both only have the lifeline group.
Both are included to a controller with ID - 1.
I place device 3 into devices 2’s lifeline group via Association Set.
When a button on Device 2 is pressed, it sends a Basic Set to Device 3.
How does Device 3 know to respond to that message sicne it did not come from the controller?
Because the basic set command in that case came from device 2… So it came from a device recognized on the same ZWave network as device 3… Why wouldn’t it respond?
That’s what zwave direct association is. 
When you set up the association, the controller gives the target device permission to send a “basic“ (that has a specific meaning in a zwave context) command directly to the trigger device.
How does Device 3 know that Device 2 is in that same network?
Because you included it into your smartthings network - it knows everything about the network it’s joined to - evidenced as the hub being in the lifeline group. Edit: the ZWave protocol discards any messages that don’t originate on the same Zwave network - the network of the sender is included in the message encapsulation… It’s part of the protocol.
Also (JD can go into more detail here) but in most cases, the lifeline group should be reserved for the hub only - if you want to control another device put it in group 2.
You send device 2 an Association Set to add device 3 to grouping identifier 1.
How does Device 3 know it is allowed to receive messages from device 2?
Saying that that’s how it works or that it is connected to the controller doesn’t really explain anything.
Device 3 is included to controller nodeid 1. Device 2 is told by association to send messages to Device 3. Why would Device 3 respond to a message ‘directly’ from device 2?
Let’s assume we are only using the lifeline group.
Because BOTH Device 3 and Device 2 are part of the same network
Device 3 only knows it has a device ID in Group 1 (edit: it was given permission to add the device by the hub when the association was made) - so when something happens it sends a basic set command to the devices in the association grooup. Doesnt matter if that device is there or not. It broadcasts the command.
Device 2- part of the same network sees a properly formatted basic set command destined to it FROM a valid participant on its network that has valid keys so it just does what it says. Period. It’s that simple.
Because that’s how Zwave is designed to work. Seriously, it’s not any more complicated than that. It doesn’t respond to just any message, only to properly encoded “basic“ messages.
Think of it this way. Device three doesn’t know anything about device two. It doesn’t care about device two. It cares about receiving properly encoded instructions from the network that it belongs to.
What direct association does is let the controller approve device two sending those properly encoded network messages directly to device three without going through the hub each time. Only a basic command and only to the specific targets that were approved when the association was set up.
When device three gets the message, it literally doesn’t know whether it’s coming from the hub or from device two. It just knows that it’s a properly encoded message from its network with the correct security keys. The fact that it came from device two instead of from the hub is transparent to device three, even more so because of the nature of a mesh network where the message may have come through a repeater anyway.
Lifeline Group wasn’t enforced with older Z wave Devices
Also, “lifeline group“ was just a convenience in older devices. It wasn’t enforced. There were some devices, like Fibaro, that used association group one for direct association and association group two for messages to the hub. So if you have an older device that lets you put other devices into group one, it’s just group one. It’s not technically the “lifeline group” until it is restricted to just the hub. So if your devices only have one association group but they are allowed to use that for direct association to anything other than the hub, the manufacturer may call it the lifeline group, but it isn’t really.
It might help if you tell us the brand and model of your devices. Then we could give you answers specific to your set up.