Your login permanently locks an account after 5 failed attempts. What is the main risk of this policy?

Attackers can lock real users out on purpose. This is a denial of service. Anyone who knows a username can lock that user out. With a script, they can lock out many users.

The policy also doesn't stop password spraying, which tries one common password per account.

"It makes stored hashes easier to crack offline" is wrong. Lockouts only affect online login attempts. They don't change how hashes are stored.

A better policy: temporary lockouts with exponential backoff (the wait doubles after each failure), plus per-IP limits and MFA.