Comment by ss248

>Why wouldn't they be?

Because it's trivial to implement decent ratelimiter which stops attackers, but still allows normal users to login.