It’s not thinking; it’s counting digital sheep. It knows instantaneously that your password was wrong, but it then ticks off a few seconds before re-prompting.

There’s a delay before re-prompting you for your password to reduce the effectiveness of rapid-fire automated password guessing attacks.