I’m writing on the roles of selfmade webmaster and pure end user, but…
Invalid login is error 200 by definition. Sure, it can and should be internal error of an app, and at some point generate something else, like error 403 plus something else like sending recovering link, but it shouldn’t or can’t happend right away.
Fail2ban is a nice tool but really overrated. Let’s forget docker, because it makes everything harder, but just the fact it can bypass iptables of VPS is really haze thing for me. But bots have tendency change IP after every 3rd attempt and that makes Fail2ban quite toothless against pure brute attack via login.
Script kiddies are another story, of course. Thay copy&paste everything they find, give a spin and don’t play with IPs. Then Fail2ban can stop them, even they can rarely do anything harm, but increasing load. The real issue is amount of script kiddies when there is instant flood.
But as long as VPS can handle such situation it just doesn’t matter. Now is 2023 and mostly those a-holes are knocking ancient vulnerabilites of wordpress on discourse-site 
But we should have some logic to stop constant logins, no matter it is not an everyday threat, I reckon.