I understand why you might want to block those specific countries, but in my personal cybersec experience, most of the malicious traffic actually comes from AWS and other big enterprises, mainly because of compromised servers hosted there. So I actually don't know what specifically you get by geo blocking, bad guys will still reach your internet hosted service.

Only a single-digit percentage of bruteforcin and scanning attempts gets to our servers once we blocked China and Russia. Going by pure volume they're overwhelmingly overrepresented. I don't know about attack quality, I just assume sophisticated attacks could originate from anywhere, so I just pick the lowest hanging fruit