By default most software seems to have rather low "burst" settings, like 3 to 5 login attempts before a temporary autoban for a couple minutes. Especially banks have a very low limit before access is denied.
I find this to be very annoying and if I can I'll always set it to allow 10 or even 20 login attempts. My password are non-dictionary and bruteforcing in under 20 attempts is out of the question. If you have a number of passwords that are possible, for example from looking over my shoulder, you'll figure it out eventually anyway, autobanning or not. Sometimes software automatically attempts a number of logins, making you trigger the autoban already because of that. Lots of ways for legitimate users to trigger the ban.
So I'd set it to a higher value, but then after the 10 or 20 failed login attempts, I configure services to autoban for a rather long period (24 hours instead of a few minutes). Surely that's no legitimate user, or they really did forget their password.
Why don't more websites and software do this by default? By now I have a pretty long (mental) list of passwords that I use. After not using a service for a while it might be any of at least 3 different passwords, each having 2 or 3 variations, and each variation needs to be typed twice to be sure you typed it correctly. Especially those services that allow only 3 attempts are also the ones that enforce ridiculous passwords (8 character uppercase, lowercase, digit, special character, no spaces, no longer than 12 characters... try remembering what permutation you used there to make this work).
Same goes for delaying login attempts, FritzBox routers are really good at this. One failed attempt is 8 seconds delay, the next 16, the next 32... really great, except my fat fingers might end up getting me a delay of 16 seconds while I only had two failed attempts. I'd rather like that it limits me to two attempts per second and jumps to 300 seconds delay after 10 attempts.
Basically my question is: Why does lots of software default to few logins and short bans instead of a higher number of logins and a long ban? The latter seems much more practical to me. Is there any valid security reason behind this, or is it just another of those common practices that are there because they made sense at some point in history?