Part 4 (v1.04) table 106 contains several items where it is not indicated that Server shall report Bad_SecurityChecksFailed to the Client instead of the detailed status.

But it should be the cases due to additional information provided by Part 2 and Part 6.

Indeed, in Part 2 §6.3 indicates:
"Error codes can be used as an attack vector, thus their uses should be limited as described in Part 4.
Part 4 describes that a single generic error is returned before and during the establishment of a secure channel.
Once the secure channel has been established then appropriate specific error codes are returned."

Thus no specific error code should be returned prior to secure channel establishment and then for the certificate validation steps during establishment.

In addition, in Part 6 §6.7.6 it is indicated:
"If decryption or signature validation fails, then a Bad_SecurityChecksFailed error is reported.
[...]
At this point the SecureChannel knows it is dealing with an authenticated Message that was not tampered with or resent.
This means the SecureChannel can return secured error responses if any further problems are encountered."

This section only indicates reporting Bad_SecurityChecksFailed error code and that secured error responses can only be sent after establishment.

In my opinion the Part 4 §6.1.3 should be modified to indicate that the server shall only report to client SecurityChecksFailed for every step it is missing.

In addition, the following sentence might be modified to reflect that the server does not return the error status to the client but should log it:
"Each validation step has a unique error status and audit event type that shall be reported if the check fails."

And we might want to add the sentence of Part 2 in an appropriate section of Part 4, may be the Secure Channel service section (§5.5.1) ?
"A single generic error [Bad_SecurityChecksFailed] is returned before and during the establishment of a secure channel.
Once the secure channel has been established then appropriate specific error codes are returned."

Moreover UACTT certificate validation tests should check for Bad_SecurityChecksFailed error, might display a warning if specific error code is reported to client and specific error codes might be checked manually in logs.

Note: this subject was originally discussed in the OPC Foundation forum leading to the same conclusion on expected behavior of Server:
https://opcfoundation.org/forum/opc-ua-standard/error-codes-management-during-the-establishment-of-a-secure-channel/