Shouldn't the accounts be locked out after enough failed 2FA requests? If someone is managing to spam those requests, it means that they have the password and t

Shouldn't the accounts be locked out after enough failed 2FA requests? If someone is managing to spam those requests, it means that they have the password and therefore the password needs to be changed.