Istio is reported as having rate limiting, but they deprecated support for that in 1.5 (and 1.7 is current). Now they tell you to do it yourself via envoy directly. https://istio.io/latest/docs/tasks/policy-enforcement/
That issue also says that an easy way is coming in 1.9.