"The HSM-based Backup Key Vault will be responsible for enforcing password verification attempts and rendering the key permanently inaccessible after a limited number of unsuccessful attempts to access it"

Is this standard practice for HSM? It seems to give hackers the ability to maliciously delete the users key and thereby effectively delete the users data.