I don't understand why my account is locked when there is no other evidence of compromise

Here is what to do: If your Apple ID is locked or disabled - Apple Support

If that is what you are encountering, it would seem the passwords might be somewhat less than “perfectly good” and quite possibly compromised, or that something benign happening locally (VPN usage maybe, or use of a stale password saved somewhere) is being detected as malicious activity.

Semi-related: might want to check the Apple password security recommendations for your accounts saved in Keychain, and update those as appropriate, too. If passwords are possibly being re-used, that works great right up until it doesn’t, and password reuse gets nasty in a hurry.

Derek Jones1 wrote:

…Other sources suggested that even unsuccessful attempts to log in (i.e., wrong password) can cause this condition, which makes more sense to me.

That’s the “stale passwords” I’d mentioned. Anything that reeks of a brute-force attack can lock the target, whether that traffic might originating from your own (misconfigured) stuff or from some other entity.

One of the ISPs I deal with has a hair-trigger block, and it doesn’t age out. It only clears with a support ticket.

I still would have preferred some indicator on my Mac's iCloud settings, to confirm that what the web page was telling me was legitimate. The phishing attempts I get in my mailbox are getting very sophisticated lately.

The phishing that many of us are getting. For those of us not yet getting the spear-phishing. “Fun” times.