I have a small public gitea instance that got thousands of requests per hour from bots.

I encountered exactly one actual problem: the temporary folder for zip snapshots filled up the disk since bots followed all snapshot links and it seems gitea doesn't delete generated snapshots. I made that directory read-only, deleted its contents, and the problem was solved, at the cost of only breaking zip snapshots.

I experienced no other problems.

I did put some user-agent checks in place a while later, but that was just for fun to see if AI would eventually ingest false information.