Rate limiting isn't just for performance. It's a security control.
Brute force protection: Limit login attempts. After failures, lock account or add delays.
API abuse prevention: Limit requests per user/IP. Prevents scraping and DoS.
Cost protection: Limit expensive operations. Prevents attackers from running up your cloud bill.
In interviews, mention rate limiting when discussing public APIs or authentication endpoints.