Does normal authentication occur before userSession.onBeforeLogin event?
The onBeforeLogin event is fired after the username/password is already authenticated, but before the actual authenticated session is started, which is why you're seeing the behavior you're seeing.

For the same reason that you wouldn't expect the onBeforeSaveEntry event to be fired before entry validation has occurred.

I believe to pull off what you're looking for, we'd need to add a new event... something like onBeforeAuthenticateUser.

Probably worth adding as a feature request.