Refused before the password is checked

A password hash is slow to compute on purpose — that is what makes a stolen database hard to use. It also means a machine sending five hundred guesses a minute is asking your server to do five hundred deliberately-slow things a minute, and plenty of small sites have been taken down by their own defences rather than by the attack.

A locked-out address here is refused at authenticate priority 1: before WordPress has looked up the user, before it has touched the password. The guessing costs your server a database read and nothing else.