It's the intended behavior. The problem with honoring the locale on the user preference is that the user is not available if not logged-in, so we need to rely on the cookie if the user is not available. This further complicates things as if the user uses the dropdown prior to authenticating the cookie is updated, but not the user. If we then switched to whatever the user had set when the user was authenticated we'd revert the changes the user just did.
Then why would different users use the same browser aka share a locale cookie? I don't think that's a frequent thing, especially not as os has user support, browsers have support for profiles and then there's also incognito sessions. Finally, even if users do share a machine would they not then in most case have the same locale?