I'd agree that there are always trade offs however, you could do a number of things to detect an active attack, changes in user agent, location etc can be detec

I'd agree that there are always trade offs however, you could do a number of things to detect an active attack, changes in user agent, location etc can be detected and flagged for review. Now that's not possible at scale, but for high value users,it would seem like a not outrageous countermeasure.