Many APIs trigger operations that have a per-use cost: sending an SMS, running an AI model, encoding a video, sending an email, making a payment processor call. If the API charges nothing for these calls (or the per-use cost is lower than the third-party cost), an attacker can send requests until the bill is catastrophic.
Cloud billing is usually aggregated — you see it at the end of the month, or only after a cost alert threshold is crossed. An attacker can do enormous financial damage in a few hours before any automated alert fires. Rate limiting is the only real-time defense.