>I have to disagree. You should always put limits on everything

like any orthodoxy it should have a limit put on it.

>But if there is multiple interfaces (such as a REST api etc) to your database then you have to remember to put them in place everywhere.

multiple interfaces going directly to database - that's a much bigger problem that the rest pales before it. In particular, multiple updates of limits would constitute only minor share of headache causing updates and the multiple updates itself would be just a minor share of the whole headache.