To begin with, I am considering the password protection of standard internet services like Gmail or Dropbox. They often force users to choose a "strong" password, that is many characters, including uppercase letters and digits, so probably Password1 would work.
But bank cards usually have 4-digits passwords, whose security is based on the restriction on the number of attempts, usually limited to 10. After that many tries, you must visit your bank to unlock your card.
Why do internet services not go the same way? For example, after 10 incorrect passwords your account would be blocked for a day, after ten more -- for a week, and so on. If you are its owner, than you probably would not enter incorrect password 10 times. The problem I imagine lies in the fact that somebody else may be able to block your account. But probably the IP-address check will do.
Is this lockout technique not better than forcing a user to choose a password which either only seems to be strong, or is very difficult to remember and probably is written on the back of the computer? Or at least to allow a user to choose a protection method themself?