Is brute force password cracking ever actually a threat?

I keep reading stuff in the news about how "These new graphics card can crack the average password in X minutes", or "This quantum computer could guess your password in X milliseconds"

These are all just basically clickbait right?

It doesn't actually matter how fast something can guess passwords because an online service would never allow 5 billion guesses per second, maybe only allow 1 login attempt every 5 seconds for example?

It is just that simple right? Every service …

cracking cybersecurity password password cracking threat