The problem is that ratelimiting doesn't work when your password database is leaked. Brute force attacks on the front end system basically don't happen because

The problem is that ratelimiting doesn't work when your password database is leaked. Brute force attacks on the front end system basically don't happen because rate limiting is everywhere. They'll try a handful of default passwords and move on.