IP address change flaw

The plug works great, but there seems to be a flaw in the security. When testing out the maximum attempts set at 3, lockout was successfully activated at a set time of 60 minutes. But when I turn my phone off and then back on, I can attempt 3 more times without waiting for the 60 minutes lockout time to expire. This was tested on a different IP address to confirm the security of the plugin. I noticed every time I turned the phone on and off, the IP address changed, which give me more attempts to brute force my way in.

https://ww.wp.xz.cn/plugins/loginizer/