Sure, three-strikes-and-out reduces probability of brute forcing any particular account with forced 5-digit password, but if an attacker has a list of just 25k

Sure, three-strikes-and-out reduces probability of brute forcing any particular account with forced 5-digit password, but if an attacker has a list of just 25k usernames, odds are that at least one is going to get brute-forced.