Why just those two countries then? Why don’t I see a thousand get requests for /wp-login from countries all around the world? Wouldn’t that be significantly more effective since you can’t simply block a range of addresses to mitigate it?

Even if that was the case, China/Russia having a bunch of vulnerable computers being used as proxy botnets would still be alarming.