Answer
Check whether the Customer record's 'Invoice Customer' field is populated — when it is, the invoicing/approval check gets directed at that separate invoice customer rather than the customer that's actually placing/being invoiced for the order (the 'ordering customer'). If your approval check is only looking at the ordering customer's approval status via a key reference built from that customer, it can silently miss the case where a different invoice customer (which may not be approved) is what actually governs the invoice, letting the invoice through even though your check logic itself is otherwise correct.