It is why I require authorization for expensive endpoints. Everything else can often be just an inexpensive cache hit.