That's for the phone itself, isn't it? So there would have to be some sort of hardware enclave involved that would rate limit guessing.

Signal has no end point security past the phone so they would want the phone security to be as good a possible.