sqlplus can be used even if there is no listener in the system, or if it isn't running.
How does SQL*Plus connect to Oracle without a listener?
I can connect any user using SQL*plus even with no listener running.
You only bypass the listener when you connect as sysdba*. Ordinary connections through SQLPlus still use the listener. As for how it does it, there is a special mechanism for this kind of connection, which allows a database to be administered without a working listener. I do not believe that the workings of this mechanism are published by Oracle. They want you to use the listener.
Or as sysoper*. **And only if you don't specify a database in your connect string.