Reply To: Lost password link and wrong password
The BuddyPress login widget is just a styled version of the WordPress login page. Hackers are still hitting the same database regardless of if they are finding your login widget — or more likely — blinding hitting your /wp-login.php page. wp-login isn’t being replaced here. If you are worried about brute force attacks, you should look into mechanisms created to protect WordPress (captchas, limit login attempts, etc.)
Replacing the WP login infrastructure with something else is a whole other matter, and something you would need to do on the WP side. As @djpaul mentioned, BP leaves that side of the site to the existing BP user management system.
