A quick skim of the source shows that appears to be using the iCloud auth device setup workflow which does not have any rate limiting or account lockout guards

A quick skim of the source shows that appears to be using the iCloud auth device setup workflow which does not have any rate limiting or account lockout guards in place. I'm guessing the author noticed that, when setting up a new device for iCloud, that they didn't get locked out when authenticating their iCloud credentials. They then reverse engineered this authentication process and created a script to brute force it. Not an earth shattering attack, but an astute one. Expect apple to add rate limiting soon. I'm not sure if they'd be able to implement lockout without breaking the login process with existing devices.