They're in prison until they aren't and at that point they may steal enough to make up for the stealing the imprisoning prevented.

The point of adding a 10s delay on incorrect password attempts isn’t to make it impossible to brute force passwords, it’s to slow an attacker from 600 tries per minute down to 6/min. This is enough of a deterrence to make brute forcing impractical.

If you have to wait 7 days between train robberies instead of 24 hours, that’s a big hit to the business model. Maybe enough to make it impractical.

Your analogy doesn't really help because they aren't just "delayed". Money is wasted on incarcerating them, they come in close contact with criminals, and it makes their ability to get a job, lower.