I agree with the rate limits lemann@lemmy.dbzer0.com suggested, I actually posted about this as well.

I see these additional rate limits as a minor form of mitigation for instances to protect primarily themselves. As for federation, I think there could be some more advanced form of spam detection for incoming posts from ActivityPub, though I’m not sure how it would be implemented in practice.