For our own site, we want to force a password reset email after X
amount of failed attempts. After all, if your email is compromised,
then everything is compromised.
How do you infer that the "email is compromised" ?
A more reasonable approach to brute force attempts is to ban the offending IP address for a while, that's what tools such as Fail2ban do. There is no reason to restrict the account of the victim.
If someone is trying to brute-force your account, it shouldn't cause inconvenience to you, like forcing a password reset upon you, which is most likely pointless since the attempt was unsuccessful.
If you were to implement such a "security feature" this could even turn to a form a DDOS against yourself: if a bot is continuously brute-forcing your account and forcing a password reset every time, this could deny you the ability to log in to the site.
On the other hand, being notified of repeated failed attempts is a good thing.