[degamad]

How does PBKDF2 prevent an offline decryption attack with unlimited attempts?

All it does is slow down the attempts, but for the average person's easy-to-remember password, it's probably increasing the effort from milliseconds to a few days.