The point of adding a 10s delay on incorrect password attempts isn’t to make it impossible to brute force passwords, it’s to slow an attacker from 600 tries per

The point of adding a 10s delay on incorrect password attempts isn’t to make it impossible to brute force passwords, it’s to slow an attacker from 600 tries per minute down to 6/min. This is enough of a deterrence to make brute forcing impractical. If you have to wait 7 days between train robberies instead of 24 hours, that’s a big hit to the business model. Maybe enough to make it impractical.