Well, it's also perfectly fine to require a captcha after one or two failed attempts of login. What achieves the same goal.

(Altough, some real rate limiting is better, except when dealing with a distributed bot. Maybe both.)