Actually, if the attacker is determined enough they can use enough IPs and make it really hard to detect and defend against.

I work on combating credential stuffing on a regular basis... it's quite challenging.