Comment by Marsymars

I suspect that's uncommon because basically every password manager works offline so isn't querying the server on each request, and implementing something where you trust a compromised client to rate-limit itself and report back appropriately seems like a lot of work to protect against a pretty specific threat model.