[x n]

Many of the firewall evasion techniques nmap provides don't rely so much on "misconfiguration" as they do a lack of a security control(s) being in place. Fragmented packets will only bypass things that don't queue IP fragments, decoy cloaking only bypasses stuff that doesn't implement router path tracing (and a couple other things), spoofing the source port only works on things that allow all traffic through whatever port you specified, etc etc etc.

You can learn about all of this stuff here - https://nmap.org/book/man-bypass-firewalls-ids.html