Haven't there been stories of parent's losing their phones because their kids randomly entering in passcodes forced the exponential time outs to be into the years (and longer) time frames?
I suspect most of these reports come from either bugs in the software (and some quick Googling suggests this has been the case), or perhaps that even someone (heck, even a savvy child) was trying using some sort of brute force exploit to unlock the phone.
I have a password the maximum length allowed so it's not trivial to unlock when she does that.