You need to find those fraud filters. Yes, PayPal returns the mis-match, but without fraud filters enabled to block those it’s going to let them through, and it would be up to you to make sure you’re comfortable shipping the order (or not). If you configure the fraud filters to block transactions where AVS or CVV2 mis-match, then the error would occur and be returned to the buyer during checkout.
As it is now, the system expects that it should allow it to go through as normal since you are not specifically blocking those transactions with fraud filters. As such, it shows the customer a successful order and doesn’t give them any reason to believe anything was wrong. In that setup, nothing was wrong. It worked exactly as configured.
Now, we do have an option in the PayFlow settings for Fraud Management Filters, and it sounds like you must have this set to “Place order On Hold for further review.” This would allow the payment to be processed through PayPal since the fraud filters are allowing it, and the money would fall into your account, but then in WooCommerce it would set it to On Hold so that you can clearly see it happened and make sure to review the order before shipping or deciding to refund it. Of course, if this option was set to “Ignore warnings and proceed as usual” then you the order would go to Processing in WooCommerce like any other order.
So if you want these transactions to simply be declined when AVS and/or CVV2 codes do not match you will need to get Fraud Filters configured on your account that way. If you aren’t finding anything like that then you’ll need to contact PayPal and get them to enable them for you. Once enabled you’ll be able to configure settings for AVS and CVV2 as I’ve said.