An AI that is randomly guessing passwords to an authentication/login endpoint is clearly malicious.

I think it's more like this:

Is it unethical to lock/obstruct the public sidewalk in front of your house because it blocks people who only want to pass by and look at the house?

just like signs such as no trespassing: active shooting range; or apiary[bee] yard; or open shaft mines, means that exactly, and in my region, signage is sufficient no gate or fence required.

every so often someone thinks they are too important for that to apply and they find out the signage is no joke when they encounter the target line, and backstop being hit from somewhere uprange; or violate the space of a bee hive; or fall into a shaft. some even have the nerve to complain this is a threat.

robots.txt == no trespassing == stay out unless invited