That seems like a fair policy to avoid getting DDoSed by withdrawals in periods of high demand (i.e. bank runs). Presumably they mainly intend to serve exchanges which are doing withdrawals in the $millions.

Not defending their other practices.