I think I'm missing the point completely. Why would you want an abstracted flood control when flood control –as far as Drupal core's one goes– only applies to a specific subset of authentication types? Isn't it better to let the authentication providers deal with it?

For instance I don't see the need of flood control for: _cookie_, _token_, _oauth_, … I do see the need for it in _basic auth_, _post raw credentials and get a cookie_, …