I don't quite understand the missing test label.
Obviously, tests were missing on this area before my patch. Otherwise my patch would have led to a test failure, isn't it? :)
Also, #7954 is pretty similar to this one (an optimization on the same domain) and was merged without any additional test.

For now, it seems nobody knows why the code makes the successfully logged in user wait. Therefore I don't even know what kind of test I could write :)
TLDR: please tell me how to move this fix forward

@mposolda @hmlnarik had a quick look at this one and it looks like DefaultBruteForceProtector is for some reason using a queue to write updates to logging failures to avoid concurrent updates missing an increment. However, this is a completely broken concept as even though a single node is now using a single-thread to update login events, in most scenarios there are multiple nodes in a cluster. So, either we should just remove this queue stuff, and live with the fact that some events may be overwritten, or we should handle this at the SQL/db layer. Wdyt?

Thanks, and sorry it's taken a rather long time to get this one merged. I've opened a follow-up to this one here:
#14084