That's not what happened.

Attackers queried n email addresses against trello, who responded with names and user names for accounts that existed.

No one asked trello to publish their names, so that's a breach.

This isn't completely true, but it is the current standard.

A website can detect and block many user/password attempts from the same IP and block IPs that are suspicious.

Websites can detect elivated login fails across many IPs are react accordingly (It may be reasonable to block all logins for a time if they detect an attack like this)

I'm sure there are other strategies, I don't know how often they are actually employed, but I wish companies would start taking this sort of attack more seriously (even if it's not at all hacking)

I mean, passkeys are a thing.