Because you get the right version through inheritance.
See https://github.com/rack/rack/blob/master/lib/rack/session/abstract/id.rb#L284-286

Also !session.is_a?(Request::Session) is wrong because we also have NullSessionHash which inherits from Rack's SessionHash and it's not a Request::Session see https://github.com/rails/rails/blob/91ff5c0f44fa5d0e962e3565d486e09a90029d70/actionpack/lib/action_controller/metal/request_forgery_protection.rb#L111

I'm kind of fixing and reusing code at the same time.