I've just watched this video which shows the attacker bruteforcing both usernames and passwords. How can this be achieved without hitting any limit rate? Does it mean that WordPress doesn't provide any limitations by default?
By default, there is no rate limiting in regards to login attempts on WordPress, you must install a plugin to allow enable such a feature. From I can see (Via using Google) a good plugin to do this is here, this plugin allows you to better control login attempts.
Please read the following article on how to configure it here