Most reputable services will "throttle" or block an IP address after 3 to 5 failed attempts.
For those performing authorized security audits, you don't need to "download" a wordlist; you can generate one in seconds using a simple Python script: 6 digit otp wordlist
Beyond just blocking the IP, many systems will temporarily freeze the entire user account after repeated failed OTP entries. Most reputable services will "throttle" or block an