If you don't tell them which one of many rate-limiters they've tripped, it's going to take them a lot more effort than a simple binary search.

The only secure system is one that doesn't work, perfect security isn't the goal. Good enough security is.