Only as long as you keep up the attack.

But an attack that keeps rate limits saturated doesn’t require much bandwidth (you know, because rate limits) and is therefore easy to keep up. Most services would consider it unacceptable if a script kiddie with a botnet and a generic list of usernames were able to prevent even 1% of their users from logging in.

So your solution is "sorry, come back later when the attacker hopefully stops"?

I can keep you out of your account indefinitely with a curl loop and a rotation of proxies?