The way a vendor embedding NTP is _meant_ to do so is documented here: https://www.ntppool.org/en/vendors.html
On another note, back when I ran a web hosting business we hosted a few NTP servers in the pool. It’s such a simple thing to give back, and worth anyone who can make a stable contribution doing so.
If you see high packet rate from a specific IP address or prefix, it's very likely not them abusing your service, but rather you attacking them by responding to spoofed requests.
Note that in the past I've had companies writing embedded linux based firmware using ntppool for time sync request their own vendor zones, however a lot of those requests were ignored so it's unclear if that's still expected. In the end they ended up just using the default ntppool domains since they never got their own vendor zones.
When was this page last updated? I would expect that number to be in the hundreds of millions these days, perhaps even billions.
> Do not use the standard pool.ntp.org names as a default configuration in your system
Apple's default is time.apple.com, ubuntu has their own pool, android as well, same for windows.
All the big linux distros also run their own ntp servers.
The ntppool.org stats show about 100k queries per second https://status.ntppool.org/
100k/s is consistent with on the order of lower 10s of millions of devices, with most checking every 10 or so minutes, and a few misconfigured ones hammering the server at a high frequency.
It certainly isn't billions of devices.
Having a vendor zone in the pool is not about selecting a set of servers to use, its for mitigating the hard coded server issue.
The standard NTP pool gets used (usually).
Amazon Linux uses their own NTP server for EC2 instances (and a large number of distros on AWS use it too).
Android, the most popular linux distro in the world, uses Google's NTP servers rather than NTP.
ChromeOS, another quite popular linux distro, also uses Google's NTP servers.