Comment validation is all or nothing. Either the correct password is used, or it is considered spam. Anyone who types in the incorrect password gets an error message to go back and try again, and when they do their message is still there, so they are only left to type in, or copy and paste, the correct password in to submit their message. Allowing comments that don’t type in the correct password to still store their message in the database would defeat the entire purpose of a spam blocking plugin. This is anonymous password authentication, not a filter, so an incorrect password is considered an invalid and unauthorized login attempt.
The field that contains the password has no html identification, making it very difficult to find it in the form with a script. Although this approach has so far eliminated any script from bypassing the Spam Free WordPress security, there are new strategies that will be implemented in the upcoming version.