Update:
It looks like that attribute "maxInvalidPasswordAttempts" does work after all. The object reference errors I was getting was probably related to the environment (I was also unable to debug). A reboot fixed that.
Once I was able to set the value, I tested to make sure it was working, checking the database for confirmation. You need to look at the "aspnet_Membership" table and use the following TSQL (for simplicity, really):
SELECT Email, IsLockedOut, LastLockoutDate, FailedPasswordAttemptCount, FailedPasswordAttemptWindowStart
FROM aspnet_Membership
As I mentioned above, I wrote a custom login component, thus far mimicing the functionality of the signin.ascx user control (converted to C#). I found two bugs in the original signin.ascx.vb file:
Line 212 displays the error message; however it never gets hit for the UserLockedOut error. Move one of the "End If" statements (e.g., Line 214) above the check for _userID > 0.
Doing the above also results in another error at Line 172, where _userID is delcared. Move this line outside of the "If" statement before Line 166 (where objUserInfo is declared), and it seems to work.
Warning: this may have some system-wide implications that I have not yet tested, but at least the built-in password attempts lockout mechanism seems to work now.