I am guessing that the original design was trying to avoid showing the error when the user has not finished typing the "confirm password".

Maybe a reasonable middle ground is the following (assuming "password" already filled in):

1) No error shown when "confirm password" is empty, OK button still disabled.
2) Error shown when "confirm password" in non-empty and passwords do not match. OK button still disabled.
3) No error shown when "confirm password" matches "password", OK button enabled.