I’d say your guess is right - the accounts typically get locked because hacking groups are running attacks on lists of email addresses. The email addresses end

I’d say your guess is right - the accounts typically get locked because hacking groups are running attacks on lists of email addresses. The email addresses ending in @icloud.com are scraped from a master list and the attack is directed to apple, while the custom domains are ignored because there is work involved in figuring out where those are hosted. iCloud lets the user generate secondary email addresses, it’s better to use that and keep the login email address secret.