Earlier quoted context omitted.
> It turns out it's not feasible or desirable to just let arbitrary people make arbitrary queries. It turns out where and why exactly?
Denial of service.
You can just 408-response queries after they execute for a given number of CPU cycles. And then rate-limit per-account using evercookies + browser fingerprinting + IP hashing. You can often disallow anonymous queries altogether, while you're at it; if your data is valuable, people are usually willing to register at least a pseudonymous account to get at it.