A simple lock down after several failed attempts would have fixed the normal brute force problem (11,000 guesses), yet not this new one (1 guess). Why don't man

A simple lock down after several failed attempts would have fixed the normal brute force problem (11,000 guesses), yet not this new one (1 guess). Why don't manufacturers implement this, and why isn't it mandated by the specification?