Well cache-control should be set to private for logins which means they're not *supposed* to cache it.
I would be more likely to blame CGNAT. Basically, most consumer internet users are behind a CGNAT. This is basically like when you access the internet behind a router, except it's your ISPs router. This saves them from issuing public IP addresses. So, you have hundreds or even thousands of users accessing the internet on a single IP, or millions of users on a small IP range.
Out of those people, a few hundred might use Vanguard. Out of those, 10-20 might've typed their password wrong in the last few days.
So, we have 10-20 failed login attempts from apparently the same network, trying to access different Vanguard accounts along with a few hundred successful logins of different accounts.
This looks dodgy as hell so it can be assumed that the successful logins were hackers. So, since it's clear those passwords are compromised, they should lock those accounts pending a password change.