You can also think that 403 happens before 401, despite the natural number order: you will not receive a 401 until you resolve a 403.
They have these mixed up! (Which is understandable, because 401 is misnamed "Unauthorized but should be named "Unauthenticated")
Checking if authenticated (which, if it fails the check, should return 401 for authentication error) comes first,
and then checking if authorized (which, if it fails the check, should return 403 for authorization error)
See for example https://www.loggly.com/blog/http-status-code-diagram/
