Why am I able to query a remote database without a dblink?

While researching a security concern, I discovered that users are able to query a remote database without the need of a dblink.

However, this was only true for databases that had no value for DB_DOMAIN. If a database's DB_DOMAIN was qualified with "foo.com", then a user could not query the remote DB and required a dblink.

I could not find any documentation that explains why this happens and am a very new DBA. What is it about Oracle that allows this to happen? Is the only way to prevent this to qualify every database's DB_DOMAIN with "foo.com"?