Depending on how the network is configured, node-to-node spread may be possible. Firewalls - hardware or software - are not magic and can definitely miss things

Depending on how the network is configured, node-to-node spread may be possible. Firewalls - hardware or software - are not magic and can definitely miss things. It may also have been a matter of servers getting infected, infecting hosted files in shares, and client machines open the files to get infected. Or, as another user points out, domain controllers can readily do this.