[damsalor]

Certainly not in the mentioned 2fa scenario.

I would guess that simple rate limiting would do the trick for the rest

[Zak]

Rate limiting does not solve this problem because botnets often don't make repeated requests from the same IP address. 2FA does solve it.