Yes, what you observed sounds plausible. Your misconception is probably due to thinking of the filters you used as having a sudden transition. This is one reason I don't like the term cut off frequency. Instead, use rolloff frequency, which presents a better mental image.
Keep in mind that a single pole filter, whether high pass or low pass, has a gain of-3 dB at the rolloff frequecy. For some applications you can approximate such filters as being flat at 0 dB on the pass side of the rolloff frequency, then dropping from there by 6 dB/octave on the stop side. This approximation works well enough in most cases a octave or two past the rolloff frequency on either side, but is not valid near the rolloff frequency. This is one reason such simple filters are usually placed a octave or two past the desired pass band.
For example, you could place a couple poles of a simple high pass filter at 10 mHz, and you wouldn't get much attenuation by the time you get to your desired 25 mHz cutoff frequency. Of course the drawback is that some content below 25 mHz will be passed. To know what is acceptable, you have to have a spec for how flat the pass band needs to be, or at least the maximum attenuation you can tolerate at 25 mHz. You also need to specify how much minimum attenuation you need at some lower frequency. No, you don't get to say pass everything above 25 mHz and nothing below, since that's physically unrealizable.
For the sharpest possible transition between pass band and stop band, use a sync filter. Fortunately your frequencies are low, so something with a lot of points, like 1024, is quite feasible to do in real time on even a small and cheap DSP. Since your highest frequency of interest is 2 Hz, you have to sample at 4 Hz minimum. However, I'd sample significantly faster than that and apply low pass filtering digitally, which can then be dessimated to a bit above 4 Hz. This puts less constraint on your external hardware anti-aliasing filter.
For example, let's say you put two poles of simple R-C low pass filtering in front of the A/D. You don't want it eating into 2 Hz signals much, so you move the two poles out to 10 Hz. The combined filter will drop 12 dB/octave or 40 dB/decade. You can easily sample at 200 Hz, low pass filter, and decimate, and use a tiny fraction of the cycles of the DSP. Let's say you decimate to 10 Hz sample rate (1:20), so the Nyquist frequency of this sample stream is 5 Hz. Looking thru all the above, you can see that input frequencies that can cause aliasing should have been well stomped on.
Now you have a 10 Hz sample stream you want to apply a sync filter to. Let's say 1024 points, so you have to perform the multiply-accumulates at 10 kHz. Yawn. There is plenty of headroom to make the filter wider, probably limited more by RAM than cycles at this slow sample rate. In any case, even a 1024 point filter can probably be placed only 1/2 octave below the minimum pass frequency. Your desired signal above 25 mHz will be pretty much untouched, and below 12 mHz pretty much attenuated to the noise floor. Of course you'll have to figure out the details since you haven't specified important parameters like what your noise floor is, minimum acceptable attenuate in the pass band, acceptable transistion frequency range, and minimum required attenuation below that.
Best Answer
What you're missing is the bandwidth, both of signal and noise.
If you look at, let's say, a 1 V rms sinewave signal, together with 10 V rms noise on an oscilloscope, you'll see only noise.
However, if the noise occupies a 1 MHz bandwidth, and is flat with frequency, and you pass the signal + noise through a 1 kHz bandwidth filter centred on the signal, then you will eliminate 99.9% of the noise power, dropping its amplitude to 0.3 V rms. The signal will then be clearly visible.
A lock-in-amplifier is a neat way to make a very narrow filter centred on the frequency you feed in as the reference.
You can use the same principle even without sine waves. Spread spectrum systems like CDMA and GPS use a pseudo-random square wave signal as the reference, and call the 'multiply and average' process convolution or correlation. As long as the reference is is the same as the underlying signal, and as long as the averaging process produces an effective bandwidth small enough to drop the noise power, the signal can be 'dug out of the noise'. A lock-in-amplifier is a special case of the more general 'correlation with a reference' that's used for CDMA.