If you want to prevent users from altering their time use your server and do a time compare with your server.
NTP can be easily intercepted and altered so it would make a lot more sense to do this via a encrypted certificate pinned communication path increasing my work load drastically to alter the time.
I snapchat going to pay for the DDOS they created?
The library was only doing a couple request per NTP server, so rate limiting really wouldn't have helped.
Also, NTP runs on UDP rather than TCP, and it only requires one packet from each party to exchange time, so it's harder to rate-limit it without making your server unreliable.
NTP has KOD (Kiss of Death) which was meant for that situation, but it is often ignored/not handled properly by applications :/
It doesn't say anything about synchronisation between phone and server.
EDIT: In fact it is easier to implement it this way than using NTP. I've implemented something similar and I found it easier to add an API endpoint that returns time() than to ship an NTP client...
And you don't care whether the time on the server is running accurately if you're just using it to generate tokens which are checked against the time on the server. It just needs to be consistent, it could be an arbitrary counter and would still work fine as long as it counted up reliably at consistent intervals.