It so happens that someone was having trouble writing a login script to run after failed attempts. And they needed not only a login script but one to run after some number of failed login attempts and to commit some arbitrary actions.

You could do that with fail2ban, sure. But in this case there’s already a native way to handle it without going outside most standard Linux installs. Because the authentication layer is handled by PAM.d