> a well-designed password (or similar) validation endpoint will both limit attempts per IP and per user

I hope you‘ll never have to reset your password then as I‘ll happily send out those 5 requests every hour to lock you out ;-)

This is also a kind of attack.