More or less like a .htaccess, but it does not use any system file, and works with any Unix-based HTTP servers. It also whitelist you for a while (using PHP session), so that it will not ask you again for the password if you log out and then log in 10 minutes later.
A custom login form/plugin may not always need to use the wp-login.php script. It can manage the user authentication and redirect him/her to /wp-admin/ folder.
NinjaFirewall only deals with the wp-login.php script.