wp-login.php not blocked with custom url

I have installed this plugin on a few of my client’s website. I love the security features and have read all the instructions to make sure I’m using the correct settings.

Because my site was under a botnet attack, I decided to use a custom url. The custom url works perfectly. However, so does mysite.com/wp-login.php. I have disabled access to wp-login.php, however if I type this directly, it still works – it does not cause a 404 error as it should. I also disabled automatic redirect from mysite.com/wp-admin and that works fine (it does cause the 404 error as it should).

Why is wp-login.php still working? It should be a 404 error.