Keep in mind that /usr/local might contain user-created files and directories and might not have their permissions set strictly like other system directories. If you create something in there and then run brew, your normal user permissions are enough to silently overwrite things.

That said, brew is (usually) smart enough to notice if a file already exists, and it will simply leave it be and prompt the user. The problem at that point is that the force link command works without sudo and will happily overwrite anything with a symlink to the Cellar-installed version.