Yeah, as it is it only works if the brute force algorithm gets it on the first try.

  SessionSuccessfulLogins == 1

It rejects the first [correct] login attempt (it’s worded poorly). It assumes that a brute force attacker will try any given password once and move on, while a human user will think they made a typo and try again. This works until the attacker realizes that it takes two attempts, in which case it merely doubles the attempts required to breach the account, and simply requiring an additional password character would be vastly more effective.

All tools that bruteforce passwords attempt each password only once, and if it doesn't work, discard it. Nobody really runs 2 identical attacks back to back (they're incredibly slow when done over the internet), so the password would seem uncrackable at first glance.

This approach wouldn't work with hash cracking, vault breaking or file encryption, because once they get their hands on the hash/vault/file, the attacker can use their own code for hashing/checking a password candidate.

It doesn't. Cracking programs don't use the user login form repeatedly. They use the same algorithm that creates the publicly encoded password to generate encoded passwords and keep going until they have a match. Besides getting the encoded password and salt, everything is done offline.

This just creates a really bad user experience.

They'll change the correct password every time because they are told it is wrong.