Why session controller checked confirmation before validate the password?

[1997roylee]

devise_token_auth (1.2.0)
devise (4.8.0)

            if @resource && valid_params?(field, q_value) && ([email protected]_to?(:active_for_authentication?) || @resource.active_for_authentication?)
              valid_password = @resource.valid_password?(resource_params[:password])
              if (@resource.respond_to?(:valid_for_authentication?) && [email protected]_for_authentication? { valid_password }) || !valid_password
                return render_create_error_bad_credentials
              end
              @token = @resource.create_token
              @resource.save
      
              sign_in(:user, @resource, store: false, bypass: false)
      
              yield @resource if block_given?
      
              render_create_success
            elsif @resource && !([email protected]_to?(:active_for_authentication?) || @resource.active_for_authentication?)
              if @resource.respond_to?(:locked_at) && @resource.locked_at
                render_create_error_account_locked
              else
                render_create_error_not_confirmed
              end
            else
              render_create_error_bad_credentials
            end