If you install package A and it depends on a newer B then the transaction fails if B is not a high enough version. BUt that assumes that A’s spec file lists a version for B.
If the packaging has errors then after an update you may have issues,
but it not dnf that allowed that to happen. Its the maintainer that did not write the version requirement in to the RPM spec file.