You're assuming that the verification is being done by the bank itself. This is under the assumption that there has already been a security breach. The password database has been stolen, and has just been sold to the highest bidder. In that case, there is no lockout.

Not if they steal the database. No matter how you limit the external access you also have to protect against people with unlimited time with a copy.

That is nice and all, but the scenario we are talking about is a db compromise, in which case any rate-limiting is circumvented.

That defense also works for plaintext passwords.

Tell me why plaintext password storage is bad, and you'll defeat your own argument.