If they suspend an account after, say, 20 password attempts, they're success rate at stopping password guessing will be vanishingly close to 100%. Especially if

If they suspend an account after, say, 20 password attempts, they're success rate at stopping password guessing will be vanishingly close to 100%. Especially if they've instigated strong passwords. If passwords cannot contain dictionary words and must be mixed case with at least one special character in digit, there's no freaking way anybody's going to guess their way in, with a small number of tries before the account is frozen. The number of penetrations from that is going to be so tiny, it's not worth worrying about. The bigger worry are stolen password hashes being cracked surreptitiously, where the attacker has an unlimited number of tries whose rate is only limited by their hardware.