Unlimited login attempts let attackers guess forever at machine speed. Progressive delays and lockouts after repeated failures turn brute-forcing from a quick win into an impractical grind — and generate an alert besides.
“Infinite guesses means they will eventually guess right.”