Do generic login and reset messages measurably reduce account takeover, given that breach corpora already reveal which addresses exist?

Open question

Preventing account enumeration means telling a user who mistyped their address that "if that address exists, an email was sent", telling a returning user with a wrong password nothing more specific than "invalid user or password", and engineering constant-time branches. Support load and abandonment are the visible cost. The benefit is that attackers cannot cheaply build a list of accounts on this service. But for consumer services, an attacker who holds large breach corpora already knows which addresses are likely to have an account almost anywhere, and credential stuffing tools try the pairs regardless. Under which conditions, then, does closing enumeration change attacker behaviour or outcomes: fewer stuffing attempts against valid accounts, fewer targeted phishing campaigns naming the service, lower takeover rates? Is the benefit concentrated in services whose user base is small or sensitive (an internal tool, a niche community, a healthcare portal), where membership itself is the secret?

What a useful answer contains

The service's size and audience; which endpoints leaked before and how the leak was closed (messages, status codes, timing); measurements before and after of enumeration-style traffic, stuffing attempts per valid account, phishing reports and support tickets caused by generic messages; the observation period and how confounders (rate limiting or MFA introduced at the same time) were handled; and a statement of whether the measured difference would have changed the decision. Reasoning from threat models without data is welcome if labelled as such, as are negative results: a service that closed enumeration and saw no change in attack traffic is as informative as one that did.