Guessing is slow for a person and fast for a script. If your login, one-time code or password reset endpoint answers every attempt without slowing down, an attacker can run through common passwords for one account, or through every possible value of a short code, in a practical amount of time.
Short numeric codes deserve the most attention. A code with few digits has a small number of possible values, so it is only safe when the number of attempts is capped and the code expires quickly. AI-generated auth flows frequently verify the code correctly but never count failed attempts, which leaves the door open.
Limit attempts per account and per IP address, add increasing delays after failures, and expire codes after a few wrong tries. Be careful with hard account lockouts, because an attacker can use them to lock real users out on purpose. Two-factor authentication, strong password hashing and a managed auth provider with these limits built in all reduce the risk further.