There wouldn't be much value to it if it could be bypassed, now, would it?
There are a number of scenarios in which TCP wrappers might be made ineffective, though. Misconfiguration is almost certainly the most likely -- a mistaken netmask, misspelling of a service name, and so on. You might also be running a service which doesn't support TCP wrappers, which is more common than you might think, and not realise it (configure it in
hosts.deny, but nothing ever happens). Then there's bugs, which these days I'd consider "unlikely", but you should never discount them completely.