As someone who written countless of this authentication mechanisms or led teams that have, there has been 0 times the vague message have been by accident like y

As someone who written countless of this authentication mechanisms or led teams that have, there has been 0 times the vague message have been by accident like you described and 100% on purpose to prevent information leakage. But that's just one (20+) anecdote(s).