Regardless of the value of Timeout (including On browser refresh), every time you perform a page reload (including a normal reload - F5 or changing the language), the web vault will execute the Vault timeout action immediately after.
I found this issue has appeared and been fixed before, but it seems to have reappeared.