Does not block bots

the more important question for you is: were they able to actually *hack* your wp-admin, or did they just throw a bunch of traffic its way?

this plugin is not intended to prevent every form of attack, but minimize the risk of fake interaction (such as comments and logins) *succeeding* on your site. brute force attacks should be handled by htaccess rules, content request filtering and similar server-side controls. this will prevent brute force attacks from succeeding to login, but it won’t prevent their bandwidth and resource consumption.