That looks like it was coming in through one of the emergency exit shafts which would be inside the floodgates.
NYCS flooded b/c the water poured into the stations. Not sure there's anything you could do to avoid that.
Allowing water from a single point of failure to flood the entire system isn't the best design. The NYCTA did a pretty good job at sealing up some of the vulnerable locations, but it appears that in the future all of the lines through lower Manhattan will need to be isolated from the deep river crossings. I wouldn't give their preparations an F, but more like a C given the week of advance warning that was available to plug up the holes. Hopefully Amtrak will find some way to deal with the exit shafts and also any potential flood risk coming in from the Jersey side.
Keeping this short. The main point of the floodgates is to protect the station from the tunnels, not the tunnels from the station
Water can enter from other points and not all end points have gates.
They should protect both from both. Photos show that the West Side Yard aquadam was overtopped and who knows what was coming in through the Empire connector. Besides if they don't work in one direction they won't work in the other so if water did get through them they should be fixed.