It can be secured from server files, on apache with .htaccess and on NGINX from the config file, no?
It all depends on the load since you will steal PHP resources on the applicaiton, that can be used to serve the site for users. Of course helps to stop hackers, spam and trash traffic. But why can’t this purely be done without executing PHP on page load from your plugin?
I prefer doing everything directly on the server but with help from e.g a plugin to stay up to date and then run Cloudflare WAF that stops the attack on the edge.
But I like your plugin and would like to use it but against PHP execution, and I would like you to include a global net like itheme security. If you tag an IP as “bad/toxic” on site why not block it in the network so it won’t even reach the other sites in the network that has secupress installed?
Just try to mutual help both parties here ??