As trivial as your statement sounds, thanks for finally explaining something which to me never made sense under most conditions :-)

This attack must rely on secrets being the same in prod and test. They should also solve that problem!

But most auth implementations don’t bother checking it.