SCRAM Iteration Count Attack
You are correct.  This is mentioned somewhat obliquely at the beginning of §9 ‘Security considerations’:


  If the external security layer used to protect the SCRAM exchange
     uses an anonymous key exchange, then the SCRAM channel binding
     mechanism can be used to detect a man-in-the-middle attack on the
     security layer and cause the authentication to fail as a result.
     However, the man-in-the-middle attacker will have gained sufficient
     information to mount an offline dictionary or brute-force attack.


Thus, you should really avoid using SCRAM to authenticate the server to the client.  You might prefer to look into a password-authenticated key exchange like SRP or SPAKE2+ instead.