Still getting failed login attempts periodically

I installed this plugin on few websites in last few months and i noticed significant decrease in failed login attempts and password recovery, however, periodically i still get notifications of failed login attempts. I am using wordfence for monitoring and i get emails when someone try to brute force login, etc…

Somehow from time to time some bots sneak past the plugin and try to brute force access.

Standard website access should be blocked and redirect to error page, while new url set by plugin is not known to anyone else except me. So my question is how is this still happening, can i do something more about this?