Audit says my 404 login page lacks brute-force protection

No. If every response was a 404 or 405, the test never reached a login form at all, so it couldn't measure rate limiting either way. A missing page can't be brute-forced.

Test the address your login form actually posts to (check the form's action or your browser's network tab when you log in). You should see it start refusing requests after a set number of attempts.

Tested the real endpoint and it enforced the limit after 11 attempts. So the first result was just the wrong address?

Exactly. We've since changed our own Security Audit so that when every response is 404 or 405, it says the address doesn't exist and the test couldn't run, rather than suggesting a missing protection. A good test should say "unknown" when it can't test, not guess the worst.