> could be straightforwardly removed or replaced with rate limiting login attempts per IP

This is very outdated intuition. Fresh IP addresses cost peanuts.

For example, your solution still allows an attacker to run a 50k item /login combolist against one of your users with $5 of botnet time, each IP address trying a single uname/pass combo.

Here you pay $18/GB to multiplex your abuse (cred stuffing being classic non-volumetric abuse example) across 72 million residential IP addresses. https://luminati.io/