I think what @markmaurerrr is trying to point out is that strings such as
__('<strong>ERROR</strong>: Enter a username or e-mail address.' )
or
__('<strong>ERROR</strong>: Invalid username or email.' )
are no plugin-specific strings (and therefore do not need to be in the plugins domain).
When you remove the all-in-one-wp-security-and-firewall in the function call, it will fall back to the default WP translations (which is totally fine, because all of the core strings are of course translated into german)
