Hacker News Reader

> There's no reason for it

The reason is to add a delay when bruteforcing passwords.

Bruteforcing is only really done with the password hashes in hand. Attacks on live systems are done with credential stuffing.

Definitely not for local password authentication, and I'm dubious it helps for ssh either. See my other comment.