The difference is blacklistd is just a api and a database for telling the firewall to block ip's. The decision to inform blacklistd is on the application side,

The difference is blacklistd is just a api and a database for telling the firewall to block ip's. The decision to inform blacklistd is on the application side, and not a scanner that checks the log's produced by that application. And yes, DoS is a very good example, if your application writes so much log's (during a attack) and fail2ban has to analyze them during that, then machine could very well DoS itself, the blacklistd approach is much simpler and straightforward BUT (and that's a big one) the applications has to support it.