There are several different types of attacks that passwords are subjected to, just as there are a number of defenses that can be implemented.
bcrypt and / or a password lock-out are just two of many possible defenses.
Password Strength is a fairly decent article.
To specifically answer your question as to why the combinations are required - It's the only means available to force the selection of a strong password. A strong password really means high entropy (change) between the characters of the password. The greater the entropy then the greater the range of bits available for the encryption (such as with bcrypt). A low entropy (weak) password doesn't use the full space available for encryption. What you thought was 128-bit or 256-bit encryption ends up being a lot less because the full range for keys wasn't used.
Some numbers might help explain things more clearly. We'll use an 8 character password for the example.
All lowercase passwords only have 26 different combinations. So that's 26^8 or 2.1x10^11 different combinations.
Adding in uppercase characters doubles our space (now 52 not 26) but buys us many more combinations. 52^8 or 5.3x10^13, which is a gain of roughly 250x.
Start adding in numbers or special characters and you can easily see the effects of forcing more entropy in the key space.
In reality, we still don't have that full key space since something that is able to be remembered generally doesn't have a lot of entropy to it. But the requirements help push more entropy into the password.