Yes and no. The rate limiting can still be done server side. Reacting to events is simplest on the client, but if you were being a hard ass about it you could do something with correlationIDs. I think it depends on how much state history you want to retain on the server to map actions to outcomes.
I’m not arguing that there’s no rate limiting going on in the server, but some things such as not being able to call several api commands with only one hardware event are enforced client side because by definition the server has no idea about whether a hardware event happened.