I will absolutely say that a distro making that claim should not worry about the difference between 3 and 10 password attempts on sudo (i.e. when you're already logged in).

> Especially since it's not vetting that actual security of the password itself?

Yes, that should be fixed. But it's a separate matter.