Without rate limiting, compromised API keys enable indiscriminate exploitation. Attackers execute automated attacks at scale, rapidly cycling through multiple compromised keys. Rate limits provide essential defense, preventing abuse even when authentication credentials are breached.