>preferably asking for the password/code if you look up more than 5 passwords too quickly

Great, so rather than being able to access all your passwords, the attacker can only access your two personal email, company sso (including email), and two bank accounts. The rest can be obtained with password resets.