If a Network Authenticator is implemented, authentication can take several frames, or even seconds, or even minutes depending on complexity (e.g. account creation, character selection, etc.).

Kcp Transport invokes NetworkClient.OnConnected immediately, which calls NetworkTime.UpdateClient:

NetworkTime.cs

internal static void UpdateClient()
{
    if (Time.time - lastPingTime >= PingFrequency)
    {
        NetworkPingMessage pingMessage = new NetworkPingMessage(LocalTime());
        NetworkClient.Send(pingMessage, Channels.DefaultUnreliable);
        lastPingTime = Time.time;
    }
}

Server kicks the connection because NetworkPingMessage gets to server before Authentication has completed and server still has that connection in KcpState.Connected, logging this on server:

KCP: received unreliable message in state Connected. Disconnecting the connection.
UnityEngine.Debug:LogWarning(Object)
kcp2k.KcpConnection:RawInput(Byte[], Int32) (at Assets/Mirror/Runtime/Transport/KCP/kcp2k/highlevel/KcpConnection.cs:447)
kcp2k.KcpServer:Tick() (at Assets/Mirror/Runtime/Transport/KCP/kcp2k/highlevel/KcpServer.cs:206)
kcp2k.KcpTransport:LateUpdate() (at Assets/Mirror/Runtime/Transport/KCP/MirrorTransport/KcpTransport.cs:125)

Bottom Line
It's not Kcp's role to be draconian here. Mirror will deal with inappropriate messages. Kcp needs to just pass the message through and not worry about it.