not all addresses protected

Same here with WP 4.1.1. and plugin version 2.2.

If I set my custom login URL to something like ‘abc’, accessing mysite.com/login will redirect the visitor to mysite.com/abc, defeating the purpose of “hiding” the wp-login.php form.

Just create an empty file
“login”
exactly at that location
“mysite.com/login”
then the displayed page will be empty
(and it will not redirect to your chosen login page).

??