On Windows, I've never used VNC without SSH, as (most?) VNC servers have no protection against brute force attacks (and thus allow for an unlimited number of attempts to guess the password).

I wonder if Screen Sharing in OS X has some built-in protection?

Screen sharing requires both the login name and password then rejects login after three failed attempts.

I did some testing with Screen Sharing enabled for standard VNC clients, like to access a Mac from non-Mac OS X systems. (In System Preferences, Sharing select Screen Sharing, and then click Computer Settings. Here, one can enable and set "VNC viewers may control screen with password".)

It seems that a VNC client can try to connect as many times as wanted.