Yeah I can confirm that if you’re using New Universal Login with no customization html for login/signup widget, then you’ll see the error from api.access.deny.
If you’re customizing the html look/feel of the html, or using Classic login, then actions can only return a generic message, you have to use rules if you want a specific message there.
EDIT: I finally did figure it out here Pre-Registration Action calls api.access.deny, how to show specific message in Universal Login - #4 by jesse2