That defeats the brute-force attack protection…

The idea is that brute-force attackers will only check each password once, while real users will likely assume they mistyped and retype the same password.

The code isn’t complete, and has nothing to do with actually incorrect passwords.