Oracle DB Security Issue: Anyone can login using SQL*PLUS, with any username, and any wrong passphrase
The OSDBA group (typically, dba)
You must create this group the first time you install Oracle Database software on the system. This group identifies operating system user accounts that have database administrative privileges (the SYSDBA privilege).

This is expected behavior as you are logging the Oracle Database from the OS user which belongs to DBA OS group.
[oracle@localhost Desktop]$ sqlplus sys/abc as sysdba

SQL*Plus: Release 11.2.0.3.0 Production on Tue Nov 15 11:23:20 2016

Copyright (c) 1982, 2011, Oracle.  All rights reserved.


Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.3.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options


[oracle@localhost Desktop]$ groups
oinstall dba

[oracle@localhost Desktop]$ su joe

[joe@localhost oracle]$ sqlplus sys/abc as sysdba

SQL*Plus: Release 11.2.0.3.0 Production on Tue Nov 15 11:26:56 2016

Copyright (c) 1982, 2011, Oracle.  All rights reserved.

ERROR:
ORA-01031: insufficient privileges

Let's see which OS user group does the Joe belong.
[joe@localhost oracle]$ groups
joe

Here, the OS User Joe doesn't belong to DBA OS user group, he can not login to the database with wrong password.

But anyone who knows this problem, doesn't need to get in physically, they will be only in need of the IP address and the name of your DB to login remotely or use a script to do what they need by sqlplus.

No, this is not correct this can be controlled by remote_os_authent initialization parameter :
SQL&gt; show parameter remote_os_authent

NAME                     TYPE    VALUE
------------------------------------ ----------- ------------------------------
remote_os_authent            boolean     FALSE

Setting this parameter to FALSE can prevent such situation.

How I should unlock a user which got locked after three wrong attempts?

You can use alter user username account unlock command as SYSDBA.