The Chinese can use a foreign botnet just like anyone else. The fact that so many attacks originate (traceably) from China is probably just down to laziness but

The Chinese can use a foreign botnet just like anyone else. The fact that so many attacks originate (traceably) from China is probably just down to laziness but that doesn't mean you'll be protected if you block the country outright. Ultimately, individual IP addresses should be blocked for a certain time after your service recognizes anomalies in client behavior (such as multiple login fishing attempts). That said, it's pretty easy to block countries from accessing web apps at least if you use Cloudflare. The CF proxy passes a special field down to your server containing the country of origin. Works quite well actually.