> But in such cases surely there's some kind of rate limiter in place?

Not really, our team maintained a reverse-proxy that fronted all requests that came into amazon. And whenever we would have a self-ddos event, we'd get a request from the backend team whose service was getting self-ddos'd to shed traffic before it reached their service hosts to prevent it from browning out. In many case ddos's were coming from kindle devices which were not even easy to update so deploying a "fix" wasn't even always an option.