> Someone who really wanted to could get a CVV2 value in only 500 auth attempts on average.

That's going to trip a fraud check at the bank and get the card frozen long before 500 attempts.