They create giant databases of every breached password in rainbow tables from previously breached password hashes, and then try them all if they ever expose another breach. If they get a database in a breach they can try a lot, like trillions, very fast.

Re-using passwords makes things much easier for them.

Bots attempt passwords on sites’ login forms all the time but aren’t very effective. Usually have hundreds a day even when I had a wedding site not even listed on google. Probably only works for very short and frequently used passwords.