Specifically, the tendency to lock an account after a few wrong login attempts is effectively a DoS vulnerability for the customer, as it allows anyone who knows your username (which often even is just the account number, so essentially public information) to trivially prevent you from accessing/using your money.

Their only focus is on preventing third parties from accessing my money, but my interest is not that third parties can not access my money, my interest is that I can access my money, which means both not having it taken by third parties, but also not having it taken temporarily by the bank who want to protect themselves (if the bank locks me out from my account, that's functionally equivalent to them taking all my money out of my account for a day or two (or however long it takes to reactivate the login) - while I am locked out, I can pay just as much as when there is no money in the account).