Without limits, anyone can call your login, signup, password reset or AI endpoint thousands of times a minute. That enables password guessing, code-guessing against one-time passwords, mass account creation and costly abuse of any endpoint that calls a paid API on your account.
AI-generated backends rarely include limits, and platforms that scale automatically will happily serve the flood and send you the bill. Limits keyed only to an IP address can be dodged, and limits held in one server's memory reset whenever it restarts or when traffic spreads across several instances.
Apply stricter limits to sensitive routes such as login, reset and verification, key limits to the account or phone number as well as the address, and keep the counters in shared storage. Return 429 with a retry hint, and set spending caps at your paid API providers as a backstop.