I'm OK with showing it only after a couple of failing attempts.

you can use the config variable $g_max_failed_login_count to set an upper limit to protect against brute-force login attempts

there is a "Lost your password" option for users who fail once or twice

so I'm closing this as "won't fix", but if the feature is really desired, reopen it