NIP-42 and POW both that prevent that  but allowing non-auth npub is also important for growth of nostr. 
no normies even know how to use nostr and asking everyone to use NIp42 client is make no normies use nostr.
so RATE LIMIT is still the key