How is it possible?
It is possible because a user has both a type and an is_employee bit. Those two values are set independently, allowing or denying such users access to certain features.
So if you look at the API data for John M. Wright you'll see they have their
is_employee bit set to true. Also notice that their user_type === 'registered'.
If you go over the list of moderators you'll not find that same user there. Only being a user_type === 'moderator' gives you the diamond.
It makes sense as being an employee allows you to set status tags on (bug) reports as your work involves dealing with these questions. They are trusted to address issues that are brought up on Meta and as such are trusted to apply a correct status to questions.
Being a moderator brings you in a whole different area of features, like suspending users, delete posts and most of all: having access to Personal Identifiable Information. SE staff (except CMs) are not hired to moderate a site, nor are they hired or trusted to have unlimited access to PII of all users. I praise SE that they don't default to "All staff can do what moderators can do".
That said, it is sometimes confusing / unexpected that status tags get added by users without a diamond. There have been requests to use an extra or different "marker" to visually indicate that an user is an employee. Until now, and I expect for another 6 to 8 weeks, this indicator is not yet implemented. We have to live with the surprises ...
If you look at the user's profile, you'll see that he works at Stack Overflow (i.e., he's an employee). Stack Exchange employees have moderator-like privileges (or even higher) even though they don't have diamonds on their names.