Rails 7.1 adds authenticate_by with has_secure_password

Rails 7.1 introduces a method authenticate_by, used with has_secure_password to prevent timing-based enumeration attacks.Let's say on a website, you enter the username and password and it returns a message after 1 to 2 seconds that "The entered credentials are invalid". When you try to log in with a different username and password, the website responds within microseconds with the same message: "The entered credentials are invalid". You don't see any enumeration vulnerability here, do you? The website doesn't reveal whether or not the user exists.But do you know an attacker can still figure that out?.