If bad actors get infinite attempts, is chaos basically guaranteed?

A tiny bit of probability math says the honest answer is: eventually, yes.

Here is the uncomfortable bit. If a system fails one time in a thousand, that sounds safe. It is not, once someone is allowed to keep knocking. Give them a thousand tries and the odds of getting through at least once climb to roughly two in three. Give them ten thousand and it is a near certainty.

The defender has to win every single time. The attacker only has to win once. That asymmetry is the whole story, and it does not care how careful you were on the other 9,999 attempts.

So is it hopeless? Should we just give up on guardrails?

No, and this is the part people miss. The math only bites when attempts are free, fast and unlimited. Take any one of those away and the picture flips.

Make attempts cost something, and the attacker runs out of budget before luck arrives.
Make attempts slow, and you get time to notice the pattern and shut the door.
Cap the attempts, and infinity stops being on the table at all.

That is why the interesting safety work is rarely about one perfect wall. It is about making the thousandth try harder than the first.