Why were numerous Daedra able to enter Nirn even after the Dragonfires were re-lit?

Question

According to Oblivion lore, the dragonfires protect Nirn from invasion from the Planes of Oblivion.

From The Amulet of Kings:

The high and haughty Ayleids relied on their patrons, the treacherous Daedra Lords, to provide armies of Daedra and dead spirits; with these fearless magical armies, the Ayleids preyed without mercy upon the young races of men, slaughtering or enslaving them at their whim. ... ... Akatosh, looking with pity upon the plight of men, drew precious blood from his own heart, and blessed St. Alessia with this blood of Dragons, and made a Covenant: so long as Alessia's generations were true to the dragon blood, Akatosh would endeavor to seal tight the Gates of Oblivion and deny the armies of Daedra and undead to their enemies, the Daedra-loving Ayleids.

Most notably, Mehrunes Dagon invaded using portals to his realm during the Oblivion Crisis, which were closed after Martin re-lit the dragonfires. However, there seems to be several exceptions to this:

1. Sheogorath's portal in the Niben Bay remains open, and Hermaeus Mora can create portals to Apocrypha in 4E
2. Daedric princes Sanguine, Sheogorath and Hermaeus Mora were able to enter Nirn at will in Skyrim

Even if we say that (1) and (2) don't count because they weren't trying to invade Nirn, Umaril the Unfeathered returned with Meridia's Aurorans during the Knights of the Nine questline, with grand ambitions of seeking revenge not just against Tamriel, but against all the Divines. This appears especially strange given that (a) Umaril is immortal and half-Daedra, (b) he's also and Ayleid and (c) the Covenant with Akatosh was forged to protect Alessia's kingdom from Ayleid Armies of Daedra; one of their major enemies was Umaril himself! One would think that the covenant should apply in 3E if it did when Alessia was around.

What exactly does lighting the Dragonfires do?

Answer 1

Like many other things governing the behavior of the Daedra, the lit Dragonfires are more of a metaphysical "rule" than an actual magical shield. What they do is prevent two things:

• As long as the Dragonfires are lit, the Daedric Princes cannot enter Mundus in their TRUE form. Obviously, they have since found all manner of ways to work around that restriction, usually via intermediaries, avatars, or some form of mortal assistance.

• Secondly, the lit Dragonfires prevent the Daedra from entering Mundus en masse. There have always been Daedra slipping through the cracks or getting summoned by mortals, but direct portals could not be opened from the Oblivion side as long as the fires were lit. Even during the events of Battlespire, when a large force of Daedra invaded the titular tower fortress, the portals were opened from the Mundus side.

Some would say that this is contradicted by The Elder Scrolls Online, which often shows portals from Coldharbor opening spontaneously in trailers and other marketing materials. Within the game itself, however, these portals must be opened by several cultists before the Daedra can enter Mundus and wreak havoc.

If it helps, think of it like vampires - in most versions, they can't enter your home unless invited but the act of inviting them inside renders you powerless against them. Same with Daedra.