[tptacek]

Yes, but other authentication factors also prevent credential stuffing, as well as phishing, which is probably the most important problem in authentication.