Will there be problems with the VK API limit of 3 requests per second during an authorization attack?

Question

In contact with

Let's say an attacker starts making hundreds of left requests for authorization. We will have to check each request through the API. And here we run into a limitation. Does this mean the service is unavailable?
And what if it is not an attacker, but a habraeffect? In the first case, you can come up with an autoban of insolent IPs, while in the second, we will encounter a stream of unique requests that we will not be able to respond to in time.
To contrive with execute?