sqlplus can be used even if there is no listener in the system, or if it isn't running.
How does SQL*Plus connect to Oracle without a listener?
I can connect any user using SQL*plus even with no listener running.
As @BalazsPapp mentioned, the oracle db can be connected locally even without a listener. In this case, the BEQ (Bequeath) protocol is used, instead of the tcp-based normal oracle communication.
Although on Balazs's link there is nothing about the details of the BEQ. On unix, it probably uses unix domain sockets. On windows, it uses probably some local rpc.
You only bypass the listener when you connect as sysdba*. Ordinary connections through SQLPlus still use the listener. As for how it does it, there is a special mechanism for this kind of connection, which allows a database to be administered without a working listener. I do not believe that the workings of this mechanism are published by Oracle. They want you to use the listener.
Or as sysoper*. **And only if you don't specify a database in your connect string.