Can attackers can easily tell the 1 and 500 iteration databases and focus their resources in breaching those ones?
Yes. The number of iterations is presumably stored in the same customers database that they stole. Even if not: the number of iterations can be queried via a public API, anyone can do it if they know the email address.