The script required to create the list of user accounts may be detected by EDR tools.

A high number of login attempts could trigger an account lockout.

Compared to other password-cracking methods, using wordlists takes the longest amount of time.

It is not a bad idea; looping through a list of passwords is more efficient than trying the same password on each user account.