The brute force protection is there only to prevent guessing the password through a brute force attack. It's not there to stop DOS attacks. We don't have any rate limiting at the moment and I believe that's something that would be better introduced with a firewall / intrusion detection system.
It's non-trivial to add, especially with the fact that a single client that invokes the direct grant login could have thousands of legitimate users. I don't think a simple implementation would be much value and not replace a full fledged firewall.
What did you have in mind with regards to requirements? Ability to configure max number of requests per-client? Per-user?
For the OOM the events endpoints supports pagination as well as date ranges which should prevent and OOM issue when querying it.