Which is true exactly up to the point where some criminal decides it's an attack worth automating, as with every other attack.

The one thing that reduces the likelihood of that happening is to minimize the amount of credentials you could get your hands on using that attack.