i’d consider this to be more of a security question, than a matching one. If it doesn’t get an IP address match, Asterisk will match the From header user name against the endpoint name, in choosing which endpoint to use. This is what happens if people, as they do under a common misunderstanding, define a type=friend for incoming calls, with chan_sip, but I think it might be the default for chan_pjsip, with FreePBX. In the case of chan_sip, the username match takes precedence over the IP match.
chan_local is no longer in chan_local.so, which no longer exists. Several of the others may represent such legacy settings in loader.conf.