Most software and services seem to have low "burst" settings, like 3 to 5 login attempts before a temporary autoban for a couple minutes. Especially banks have a very low limit before access is denied.
I find this very annoying and, when possible, I always set it to allow 15 (or more) login attempts. My password are non-dictionary and brute-forcing in under 15 attempts is out of the question. If you have a number of passwords that are possible, for example from looking over my shoulder, you'll probably still need quite a few attempts. In some cases, benign software automatically attempts a number of logins (e.g. Filezilla FTP), making you trigger the autoban already because of that.
When configuring a higher number of failed login attempts, I also configure it to ban for a longer period (e.g. 24 hours instead of a few minutes). Surely that's no legitimate user, or they really did forget their password and need to reset anyway.
Why don't more websites and software do this by default? By now I have a pretty long (mental) list of passwords that I use. After not using a service for a while, it might be any of at least 3 different passwords, each having 2 or 3 variations, and each variation needs to be typed twice to be sure you typed it correctly. Additionally, the services that allow only 3 attempts are usually also the ones that enforce ridiculous passwords (8 character uppercase, lowercase, digit, special character, no spaces, no longer than 12 characters... try remembering what permutation you used there to make this work).
Same goes for delaying login attempts, FritzBox routers are really good at this. One failed attempt is 8 seconds delay, the next 16, the next 32... really great, except my fat fingers might end up getting me a delay of 16 seconds while I only had two failed attempts. I'd rather like that it limits me to two attempts per second and jumps to 300 seconds delay after 10 attempts.
Why does lots of software default to only a few login attempts and short bans, instead of a higher number of logins and a long ban? The latter seems much more practical to me. Is there any valid security reason behind this, or is it just another of those common practices that are there because they made sense at some point in history?