I would say in my experience CSRF-protection has proven very effective at even preventing targeted password brute-force.