CheckPassword hook is run at the same time as gatekeeper's hook is
The Lua hook is, yes, and is server-side.
The actual gatekeeper code is binary, running before the server connection allows client to start doing stuff.
With gatekeeper, player connects, gatekeeper binary intercepts - checks against lua controlled server side script "can player connect?" and then does whatever (allows/drops mid stream), allowing player to start downloading resources or connecting if the binary gets 'yes' response.
With PlayerCheckPassword, I'm pretty sure there is no interception, other than the split second before the player object has fully initialized on the server.
I might be wrong, but, I think all it does is,
after the player has joined server, downloaded resources, synced snapshot, it then checks to see if they're allowed.
After the fact it's too late of what he'd want.