The lack of rate limiting is surprising, either on the server side or the OS side (or both). I mean they already lock my iPhone after too many failed attempts

The lack of rate limiting is surprising, either on the server side or the OS side (or both). I mean they already lock my iPhone after too many failed attempts with my passcode and it gets longer each time, I feel like the lock here should be the same. A better prompt would also go a long way.