The problem is that the so-called 'denominator layout'
$$\frac{\partial f_X}{\partial X}(\mathbf{a},\mathbf{b}) = \mathbf{a}\mathbf{b}^T$$
is just a very special shorthand notation for the general directional derivative
$$\frac{\partial f_X}{\partial X}(\mathbf{a},\mathbf{b})[H] = \mathbf{a}^TH\mathbf{b}$$
where $H$ is the direction into which you are deriving, i.e. a general operator between the source and destination spaces. In particular, $H$ is not restricted to being a symmetric operator!
You can see the connection between directional derivative and 'denominator layout' symbolism by writing the bilinear form as a trace. The trace can be permuted cyclically (first step) and is invariant under transposition of its argument (second step):
$$\mathbf{a}^TH\mathbf{b}=\rm{tr}(H\mathbf{b}\mathbf{a}^T)=\rm{tr}(\mathbf{a}\mathbf{b}^TH^T)$$
Hence, the 'denominator layout' matrix derivative is the kernel $\mathbf{a}\mathbf{b}^T$ of the trace contained in the directional derivative with respect to $H^T$. No surprise, you were getting a little confused...
If you are sticking closely to the directional derivative, everything is clearer. Since your very special direction $H$ is not an arbitrary operator, but a symmetric one, according to your presumptions, we have
$$H=\frac{1}{2}(H+H^T)$$
and hence,
$$\frac{\partial f_X}{\partial X}(\mathbf{a},\mathbf{b})[H] = \frac{1}{2}(\mathbf{a}^T(H+H^T)\mathbf{b})=\frac{1}{2}\mathbf{a}^TH\mathbf{b}+\frac{1}{2}\mathbf{b}^TH\mathbf{a}$$
where in the last step the invariance under transposition has been used again. So, finally, we obtain the directional derivative of your bilinear form for the special case of a symmetric $X$ and $H$ respectively:
$$\frac{\partial f_X}{\partial X}(\mathbf{a},\mathbf{b})[H] = \rm{tr}\left(\frac{1}{2}\left(\mathbf{b}\mathbf{a}^T+\mathbf{a}\mathbf{b}^T\right)H\right)$$
More specifically, the question 'Where am I wrong?' can now be answered:
You used the symmetry constraint $X^T=X$ when you computed the derivative, but you did not apply the symmetry constraint to the (hidden, in your preferred notation) directional argument $H$ as well. Instead, by not paying attention to $H$, you have treated it as if it was still a completely general operator. You were vulnerable to this issue because the 'denominator layout' notation omits the direction $H$ into which you actually derive.
By applying the constraint to the directional argument as well, you would have obtained the derivative in the symmetrized form in the first place, as you can see above, and not in the unsymmetric form that leads to the false conclusion
$$\mathbf{b}\mathbf{a}^T=\mathbf{a}\mathbf{b}^T.$$