That's true if you host wordpress or joomla or something that is widely used that would have timing attack, because then someone will automate it for sure.

If you have your custom web app I don't think anyone will bother unless you are bank or something.