Sign in with google/apple can be virtually painless and only lets them know your email address, name, and profile pic if oauth is configured reasonably and its easy to tell on your side if its not because it asks for the additional permissions. You can also sign up with email without making the person go through a lot of malarky. Simply send them a sign in link instead of doing the whole normal dance. Click it and continue on.
If need be they can be prompted to fill out additional data if features require it.
I bet they implemented the login anticipating misuse… and like all other startups, there’s only a tiny chance the product would be misused, but a large chance that many people won’t use it due to the login wall.
Rate limiting is like handing your football players packs of condoms instead of cups. It might be necessary but it sure as hell isn't sufficient.
I would suggest that if your app requires interaction with others you provide them with a test experience where they can read live data but not effect others. Gate functionality that might be misused with a request for an oauth2 login or email which you can send a login link to. Near zero commitment don't have to share anything beyond your email and name don't even have to make up yet another password. A few clicks and you are done.
You can provide almost as good an experience as you want without people getting their lols or their dollars off your other users.
I understand sometimes you need auth, but the app could just show the live app and then pop up a signup modal when the user tries to do something that requires auth (that's what I do on my apps)
It also prevents from mass creation of email accounts for probing services as google is likely to detect that.