Only if the client is making the requests directly. If your own infrastructure is in between (which it should), you can limit the kind of requests and their rate at will. Of course that’s an architecture I am not sure someone who develops something like this has on their mind.