Hmm… You make a very interesting point.

I wonder how long it would take for someone to spot and report “I entered my password wrong and it worked anyway”

I was thinking of an attacker with specific goals of accessing things who doesn’t want to be found out.

Your hypothetical attacker would be more of a general chaos agent.

I have certainly encountered far more of the latter.