Most users are going to be already logged in on their phone apps so they won’t be affected. And the inconvenience is most likely going to be chucking up a captcha to prevent automated attempts.

Sure, but I’d take being inconvenienced over having my accounts compromised

You can do this without reverse engineering a password algorithm.