Perhaps look at an OS packaging system. Debian has a particularly robust one, and it simply couldn't be brute-forced like this (as it's key-based).

Even just simply forcing 2FA would be a significant improvement.