Outside of rate limiting and sending detected bad bots to poisoned static data, yeah not much you can really do without harming valid use cases.

In the federated world people can just set up relays or listener instances, which are far better than hammering hobbyist instances with the additional bandwidth.