scalable has cost and you only want to engage costs when it comes with benefits. Preventing non legitimate traffic is complementary to scalability. Just don’t pay for illegitimate traffic…

why would one do either? By whitelisting you entirely prevent traffic. API auth takes processing. How wrong is it? Maybe for your home usage it’s good enough but layering measures has value…

Innovative mechanics are generally where indies are shining though.

I’m not arguing that some AAA don’t have merits either in play time or other but from a euro per minute of pleasure overall they are not as good as indie games these last 10 or so years.

€30 vs €80 and I can play it hundreds of hours. Is that so hard of an equation ?