You mitigate that by putting MFA in front.
No, security is tough. The better security the less useful it is. NIST got this right. Do what you can, don't kill the user and implement security on the aaa side.
I was specifically addressing the DoS vulnerability of locking an organization out en masse by taking advantage of account lockout or timeout policy. A list of emails and a six line script could take a whole company offline.
MFA can be used to address that by requiring pre-auth before you can enter a password.
1. Scan a QR code.
2. You now have a secret value that can generate a deterministic pseudorandom integer securely indefinitely.
Also, SMS-based MFA should be burned to the ground.
Actual OTP should allow you to print out or write down a set of codes.
That's way different from "I don't want to give out my phone number".
"I have a phone number but don't want to give it out" is different than "I don't have a phone".
But hey, there are 2FA devices you can use instead.
Nobody gives a shit about low trust environments... go ahead and crack my slashdot account, but higher trust stuff like mail, money, network access etc absolutely need MFA.