Often password rules make slight variations of the passwords so that the damage is limited. Furthermore, attackers don't try all accounts since they don't know

Often password rules make slight variations of the passwords so that the damage is limited. Furthermore, attackers don't try all accounts since they don't know which ones exist (unless they have email access).