No rate limit + no pagination cap = the entire dataset can be downloaded. An automated client iterates through pages or IDs, collects every record, and stores it externally. What took a legitimate user thousands of individual browsing sessions can be done by a script in hours.

No rate limit + expensive operations = one attacker can saturate the server. A search endpoint with a complex database query, a file processing endpoint, a GraphQL query with 10 levels of nesting — send enough of these simultaneously and the server runs out of CPU, memory, or connections. Real users time out.

No rate limit + paid third-party calls = financial attack. SMS, email, AI inference, payment processing — these all cost money per call. No limit means an attacker can run these up indefinitely. The API owner receives the bill. In extreme cases this can cost tens of thousands of dollars overnight.