Commercial Windows licenses aren’t typically covered by the equipment installers (or if they are, the cost is passed on to you instead of subsidizing it), have expiration dates, and you’ll want security updates.
I think the comment had the implication that the system would be running on Windows if not Ubuntu.
Outside of rate limiting and sending detected bad bots to poisoned static data, yeah not much you can really do without harming valid use cases.
In the federated world people can just set up relays or listener instances, which are far better than hammering hobbyist instances with the additional bandwidth.