Yes, it is true, but it is also excessive.
That table is also used for users sending emails with the contact form. Rather than truncating that table, it is better to remove only the necessary entries.
user_login_final_validate() contains the following code.
if (empty($form_state['uid'])) {
// Always register an IP-based failed login event.
flood_register_event('failed_login_attempt_ip', variable_get('user_failed_login_ip_window', 3600));
// Register a per-user failed login event.
if (isset($form_state['flood_control_user_identifier'])) {
flood_register_event('failed_login_attempt_user', variable_get('user_failed_login_user_window', 21600), $form_state['flood_control_user_identifier']);
}
Just remove any row in the "flood" table where the "event" field is equal to "failed_login_attempt_ip" or "failed_login_attempt_user"; in that way, any login ban is removed.
This would remove the login ban for every user, including the ones who are trying to access somebody else's account by brute force. Unfortunately, without to know the IP of the user to unblock, it is not possible to unblock just a specific user: The login validation callbacks first check if the user is login banned basing on the IP, then basing on the user ID for the account used to login.