Being able to brute force logins at all would be a failed access control. So yeah its Apple's fault, they screwed the pooch there. That said, if they have a 2 factor authentication option, they are well within their rights to say "lol fuck you lazy white n-words" and literally crip walk out of the court room.