I think you need to rate limit and auth most free consumer-facing end points, given the maliciousness of public traffic. Limiting it is just protecting yourself from its worst excesses, that doesn't necessarily mean you don't want to be a platform.