On the attacker's extra tries. that's assuming a straight username/password combo with no additional data. For UK banks at least, I can't think of a single on

On the attacker's extra tries. that's assuming a straight username/password combo with no additional data. For UK banks at least, I can't think of a single one that's only username/password. The better ones are 2FA, the less advanced ones will at least have something like username+password+"some kind of secondary secret" so straight online brute force is unlikely to be successful. Also your attacker shouldn't know about the impending lockout, so unless they have some way of knowing when a user has logged in, they'll end up locking the account (well assuming username/password ofc)