could be somewhat related, last week I had a successful login for my Apple ID from a location I didn't recognise (somewhere in central asia).

I noticed because I got a prompt on my phone, which requested I allow (or disallow) the access.

Since I'm pretty good about password hygiene and security, I of course changed my password immediately and force-signed out all my devices.

That being said: if someone has a password list and is using a bot to scan them all; Apple will of course lock-out sign-in attempts.

Not to say what they're doing is right, there's better ways to handle it. But if I were to apply very recent anecdotal data to this even then this is a meaningful conclusion I could draw.