Well, 15.5 finally released.  I have tested and can confirm, after 7 months, the issue is finally considered fixed.  

Yes I didn't see 15.4 came out 4 days ago. That's our go to finally 

I spoke with TAC last week, the fix is not in the latest update, but we have some expected dates: X15.4 due in Feb 2026 will have an interim solution and x15.5 in May 2026 should have the full solution.

You would need certificate based VPN to completely stop password sprays. I may put a feature request in to Duo though, it would be great if Trusted Endpoints for SAML validated before authentication, this would be the equivalent to cert based option.