I mean true, there’s nothing you can do with a successful attempt.

But i feel like this still could have been limited. Required 2FA obvi comes to mind… You can limit rate in a lot of ways.