KDE

That's managed by PAM: https://man.archlinux.org/man/faillock.8.en

I think it's mostly intended for remote access like when SSH'ing in, it locks up after too many bad attempts.

When you have physical access a lot of security stops being relevant. Although for users with full disk encryption, that'd also force the attacker to wipe the keys in RAM so it's still got some value.

but then I can just bypass it by forcing my computer off then powering it back on. Then what's the point of having it?

You already have your answer, so I'll just add that not every implementation is the same. Our VDI deployment provides virtual desktops to remote users. Their own physical power buttons would only reset their thin client, not the remote workstation that has access to our secure network. If they want to reset that 10 minute timer early, they have to call IT and we can reset the virtual machine from our end after confirming that they're a valid user. But yes, some software security is trivial to bypass if you have no physical security.