The threat ia that someone who uses a shitty password and then their laptop gets taken by a sophisticated actor that could crack their stupid password in an hour without the TPM wiping itself after X failed attempts.

The solution, of course, is to not use shitty passwords