Someone using OTP like google auth would likely be affected on linux, but it is not default and you can hardly bruteforce it either. On top of that fail2ban should deal with such bruteforce attempts just fine.