Yes and there are several reasons to do so.
Firewalls like other computing devices occasionally have security flaws which need to be patched. If you were to think of two firewalls or firewall pairs (one behind the other) as two layers of defense if the first layer had an issue and was able to be bypassed the second firewall would be able to prevent outsiders from gaining access to your network.
Likewise different types of firewalls can process different types of attacks at different speeds. Hardware-only style devices tend to process packets at a much faster rate than software firewalls but they don't process or block packets as deeply whereas other types of firewalls can block a much larger number of types of attacks because they do inspection either for more items or cover more of the communications that are being filtered. If a client were to deploy both of these they would want the hardware firewall internet-facing to block the largest number of attacks and then have the software firewall behind it blocking attacks at a deeper layer.
Take this a step further and we have specialized Firewall devices such as Web Application Firewalls (WAFs) which only do filtering on http and https. These are almost always used in conjunction with more traditional firewalls in front of them.
Likewise in a cloud environment it is not uncommon to use a primary firewall in front and also run firewall software on each of the computers in what's known as a Zero-Trust model of firewalling which is also effectively two layers (or more).
Note: Zero-Trust firewalling does not have to have a separate firewall in front this is simply a common deployment pattern I see especially in AWS environments.
Finally to dispel said "rule": You can use two software firewalls like IPTables and mod_security (essentially a WAF) on one computer or even have IPTables forward incoming traffic to a second software firewall for further inspection for things like Data Loss Prevention (DLP) or for advanced malware or application filtering. The use of the second software firewall as a WAF is actually very common for people who run software WAF's.
That said having two software firewalls is not common in traditional computing but it's a very legitimate way to add good security controls to a system and as long as you are adding unique security controls into each layer and not negatively impacting your applications I would say it's very wise to do so.
In regards to having a hardware firewall behind the router. This is very similar to how all businesses have their own firewall behind their router and have access-lists on the router. All companies need to secure that external router so effectively almost all companies effectively do have two layers of firewalling even if one is more actively used than the other. I do this myself because the ISP has access to the network router in my house and I don't trust the ISP to secure it. This is very common in business and semi-common for home routers amongst people in the know about security.
You don't get Defense in Depth from a single layer so having a second layer is always wise and I think it would be wise to question this "rule" you mention about one firewall.
BTW: I once saw a bank that used three different pairs of firewalls in a row for it's Internet-facing banking application.
Useful links for comparison: