The web developers that think like this are bad at web development, and likely security. Why would anyone trying to brute force your authentication portal care about using your UI?
You'd probably mostly catch password managers and people copy-pasting passwords though. If you had per-user fingerprints also people typing on a new device...
KISS.
at that point you might as well outsource that sort of fingerprinting/behavior analysis to some service like recaptcha.
- Hackers haven't spent time breaking it
- It doesn't raise the same level of privacy concerns
- You control the UI (though recaptcha3 gives you that) and have greater insight into what the score means and why