Why can’t Blue Prism be configured to lock out users after 5 failed attempts?

When using Blue Prism native authentication this is not necessary as the client runs on a Windows operating system

It can. When using Blue Prism native authentication password security and lock out options are configurable

It is expected that all deployments will use Single Sign-on which negates this requirement