Generally speaking, unless you're using OAuth for an authentication, you would check your username and your password at the same time. It's just you wouldn't respond if either existed or not. You would just say invalid username and password combination.

What gets really complicated is the hybrid SSO integrations where they use a username and then if the account has SSO enabled it then redirects you to the sign-in page, Otherwise, it brings you to a password field.

Realistically what these sites should do to prevent that vulnerability would be to make it so you have to click a dedicated sign in with single sign on button. But not everyone does that type of flow.

Granted, this also doesn't include sites that convert your user account into a user ID. And then for your password's table, only give a user ID. Those would require two queries or a join, regardless, because it's two separate data places. One to get the user Id and one to get the passwords