I agree a lot of this becomes cat and mouse game but rate limiting is necessary for the health of their system if not to counter same basic spam prevention. Ideally you want to remove the incentive to spam, which in this case is figuring out emails that have registered coin base accounts that could later be phished.

If you are saying "malicious requests only come from foreign countries" then of course that is silly.

But "for these businesses every connection from certain continents is an attack" is absolutely true.

I've worked with these businesses, worked with their CEO on their business needs, and seen their internet traffic. They, really, have absolutely no need to interact with Asia. They aren't hotshot SV companies trying to become the global leader of VR selfies, they are just boring[1] businesses sending plain old physical goods to customers within a thousand miles of them.

[1] Boring isn't a pejorative in my mind, but I know it is for some other people.