A company has a local subnet where everything shares the address space 192.168.0.0/8.
Let me start out by stating that "shares the address space" does not equate to "shares the same subnet." Multiple different L3 domains can all be part of a shared address space. Any /8 is really too large to be usable as a single subnet and you will end up with a number of problems.
Second, I really hope that they aren't using a 192.168.0.0/8 as this address space includes both publicly assigned address space as well as RFC1918 address space. This would be terrible network design and indicate there are likely other issues as well (i.e. I have personally never seen a network with this kind of design flaw that didn't have others as well).
How is it possible that a single local area network can have different Wifi security levels. Aren't the devices supposed to be under the same network?
A single local area network can consist of many different VLANs and subnets each with their own access/security policy. Or you can have different ESSIDs that bridge their associated clients to the same VLAN/subnet.
And if it's possible, is it pointless to have WPA2 security for the office PCs, as I can just join the open Wifi network anyway.
Certainly not pointless, even if the two ESSIDs do provide access to the same VLAN/subnet for clients. The payloads of the wireless frames sent and received by stations connected with WPA2 will be encrypted. This makes interception over the air more difficult if not impossible.
Even if stations connected to the two different ESSIDs can communicate with each other, this does not mean that joining the open ESSID will provide you the same access that joining the WPA2-PSK ESSID does.
And say if I'm Trudy, am I able to sniff everything going on in this network, assuming no access control is implemented?
All wireless traffic that "Trudy's" station can capture (the stations must have a high enough signal to understand the data rate at which it is transmitted)? Possibly if only a single PSK is in use and Trudy has that PSK. All the wired traffic? Unless the wired traffic is vulnerable to some sort of other exploit, no.
However, wired traffic should be relatively safe in this situation. As for the single PSK, there may be different PSKs configured in different facilities or depending on vendor there may be some sort of private/dynamic/identity PSK feature enabled that can make use of different PSKs to different stations.
Isn't this a major security flaw?
Maybe? There really isn't enough information in your question to determine what level of security risk may be present. This could be a major security issue, or it could be non-existent. All depends on what is really happening "under the hood."