Your DMs are currently open in two communities: Fluxer.js and PluralFlux Support. The user in your screenshot shares a mutual community with you in Fluxer.js, which is why they were able to DM you despite not being on your friends list.
If you would rather not have these manual overrides, you can right-click on the individual communities in the sidebar on desktop and go to Privacy Settings to remove them. Alternatively, you can go to your main user settings and toggle "Allow direct messages" off and then on again. This will give you the option to apply the setting across all your communities, including the two that were missed.
Closing this, as it is working as intended upon further inspection!
Thread
Comment by Hampus