A not-for-sure harm mitigation as part of defense in depth is a great thing to put in a security model.

But with the flaw here, the effectiveness drops to zero. The "making certain attacks harder to perform" is basically gone in the scenario where someone is buying a bunch of credentials. That's not good!