Right, but they still will be slower than if there was no protection at all. 100 slower cores vs 100 cores churning out requests ASAP.
For a determined or resourceful attacker, this alone won't be good enough defense, but I can see it being a layer of defense in depth.
