The threat ia that someone who uses a shitty password and then their laptop gets taken by a sophisticated actor that could crack their stupid password in an hour without the TPM wiping itself after X failed attempts.
The solution, of course, is to not use shitty passwords