Email OTP doesn't respond with TOO_MANY_ATTEMPTS code when the maximum attempts are exceeded
The official site says "When the maximum attempts are exceeded, the verifyOTP, signIn.emailOtp, verifyEmail, and resetPassword methods will return an error with code TOO_MANY_ATTEMPTS."
Indeed it deesn't, please check your implementation.