If you don't improve the 'hardness' of the authentication scheme - that is, if you continue to use a password instead of, say, SSH keys - then, for all intents

If you don't improve the 'hardness' of the authentication scheme - that is, if you continue to use a password instead of, say, SSH keys - then, for all intents and purposes, you've just made the system more _obscure_, rather than improving _actual_ security. To be sure, a dedicated brute forcer could still brute force any system using f2b... it just might take a few months/years instead of a few days. (However, as noted by other commenters, there's something to be said about obscurity within a system's overall security scheme. You just have to strike a balance...)