We can notice that Local user can login even when authentication-order tac-plus is configured.

Below is the authentication-order configuration configured on the device.

set system authentication-order tacplus

set system authentication-order password

If the authentication order includes RADIUS or TACACS+ servers, but the servers do not respond to a request, Junos OS always by default tries the local password authentication as a last resort.

If the authentication order includes RADIUS or TACACS+ servers, but the servers reject the request, the handling of the request is more complicated.

• If password (local password authentication) is included at the end of the authentication order and the remote authentication servers reject the authentication request, the device attempts local password authentication.
• If password (local password authentication) is not included in the authentication order and the remote authentication servers reject the authentication request, the request ends with the rejection.

Reference link: https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/junos-os-authentication-order.html