Risk of account lockout attack when used with the username enumeration prevention module

First of all, I don't think this is a bug rather it may be a intended feature.

The Login Security module locks up an account after X failed login attempts:

user_save($account, array('status' => 0), NULL);

This may however be exploited by attackers to perform an account lockout attack. Although Drupal core sends account reset emails to blocked accounts, contrib modules such as username enumeration prevention will prevent Drupal from sending password reset emails to blocked accounts. This will then increase the risk a website using both modules be under the account lockout attack.