I think the area of the risk you might not be taking into account is the question "how do codes get generated?" If they are anything like the registrar I use, you only get a code when you are logged into the site as an administrator for that domain name and specifically request one. So, the attack chain requires that I somehow either compromise the admin's account or convince the legitimate admin to generate a code. In the former case, I probably already have 90% of what I want anyway, unless this is a very valuable domain name and I can't compromise the admin's email and/or change the email on the account. In the latter case, the admin who was socially engineered into generating the transfer code is probably also not going to have a problem handing over the transfer code as well.

So, the attack surface is really a domain which is already being transferred and some attacker knows the time window in which that transfer is happening and they need to beat the legitimate recipient's use of the code . It seems like one of those cases of "technically yes, but realistically no" scenarios. Sure, they could make things harder (including rate limiting and having the code expire after too many guesses). But, it's probably not something that is going end up actually having an impact.