The specification describes what should happen - from part 4

"Servers shall take proper measures to protect against attacks on user identity tokens. Such an attack is assumed if repeated connection attempts with invalid user identity tokens happen. One option is to lock out an OPC UA Client for a period of time if the user identity token validation fails several times. The OPC UA Client is either detected by IP address for unsecured connections or by the ApplicationInstanceUri for secured connections. Another option is delaying the Service response when the validation of a user identity fails. This delay time could be increased with repeated failures. Sporadic failures shall not delay connections with valid tokens."

So the test case is exercising this paragraph - i.e. one error should not cause a problem (repeated one should cause some action, but the mentioned test case is not for repeated - just a single activate session issue.) The Activatesession shall return an appropriate error, but no effect on the existing session.

Reviewed in CMP call - see note

agreed and closed in extra call