You’ve read it correctly. The idea is to mitigate against brute force by account lockout/disable following N failed attempts rather than enforcing greater pass

You’ve read it correctly. The idea is to mitigate against brute force by account lockout/disable following N failed attempts rather than enforcing greater password length or complexity requirements.