The inetd program is run takes care of this nicely. With tcp wrappers, inetd is tricked into running tcpd instead of the service that would normally be called. It either accepts the connection and runs the service or denies the connection based on it's rules. Sendmail, apache, and named do not use inetd, and so they are not protected via tcp wrappers. Check to see if tcp wrappers is installed.
Most distributions install tcp wrappers by default.
The bolded part shows the difference. One of the nice features of tcp wrappers is the ability to control access to your computers network services and log failed or successful attempts. You can also perform certain actions based on the users hostname. If neither file contains an accept or deny rule, access is granted by default. It's important to note the sequence of events here.