How likely is this attack over the Internet (rather than locally or intranet) you think? Realistically? Also wouldn't other mitigations stop it, like slowing d

How likely is this attack over the Internet (rather than locally or intranet) you think? Realistically? Also wouldn't other mitigations stop it, like slowing down retry after 3 attempts, blocking after 10 or so.