Earlier quoted context omitted.
In general, you can't assume people won't deep-link your content, and that includes embedding. Technically, no, you can't with current protocols. However, this has been regarded as bad manners ("hot linking", "bandwidth theft", etc.) since forever. Taking steps to protect against or take advantage of traffic spikes is the responsibility of a content provider. The trouble is, with the increasing concentration of atten…
Perhaps more accurate to say "Taking steps to manage traffic is the responsibility of a content host." People make HTTP requests for all kinds of reasons. If you don't have someone managing your hosting, the responsibility defaults to you. That's one of the reasons there's an ecosystem of cloud providers now to shoulder the burden of this implementation detail that people don't want to know just to make content avail…
I think it is extremely dangerous to argue that anyone who wants to publish safely on the Internet should be required to do so via some huge cloud provider. We shouldn't conflate what is technically possible because our old protocols give too much trust with what we consider ethical or legal.
You can't trust the clients to behave; assume the worst of user input.
By the same argument, spammers and those PPI cold callers are OK, because we agreed to have e-mail accounts and phones. In reality, bad actors like this screw up the system for everyone, and dealing with people who screw things up for other people is why we have laws. Treating negligence or particularly actively hostile action as the victim's fault is usually a very bad idea.