Master Password Bypass by clicking cancel

When I set up a site, I set a master password on it and at one point when needing to go to a different area after accidentally starting that site session, it asked for the master password. I clicked cancel, thinking it was going to close the initiated session, but instead, it just started the session anyways.

I did this a couple more times, through the site session file as well as from the main console and both resulted the same bypass.

WinSCP v6.1.1

The recording shows that although your stored site indeed has a stored password, which is protected by the master password, you are actually authenticating with a public key:

Authenticating with public key "kane\dennis.fair@NOC"

So the password is not used/needed for the authentication at all.