Disagree with the whole panic here. That "attack" was a teammate running a script on your own login endpoint, which is not an attack at all, that is just load testing you never asked for. Nobody external cared about your app for 8 months and nobody cares now, the free tool Dev used would work on half the internet and proves nothing about your actual risk. Rate limits mostly punish real users who type a password wrong a few times or refresh on bad wifi, and per-IP caps are easy to get around with a proxy anyway. Going from zero to 60 requests per minute per IP the same day is a knee jerk fix that will break someone's legit workflow and you will never even know it happened. You got scared by a screenshot, not by an actual breach, and now you are locked into tuning limits you did not need. So no, you were not wrong for 8 months, you were just fine.

Sounds more like operator error than the offset being bad, honestly. Stick burners need small hot fires and constant attention, not the set it and forget it thing a kettle gives you. Give that offset six months of practice and the kettle won't even be close on ribs.