Something can be critically important for a person to access on-demand and not be something they’re especially concerned about an attacker accessing. Two completely unrelated dimensions of access needs.
See: Apple ID, where failed password attempts (by anyone) causes Apple to force users to change their known password.