That seems like a fair policy to avoid getting DDoSed by withdrawals in periods of high demand (i.e. bank runs). Presumably they mainly intend to serve exchange

That seems like a fair policy to avoid getting DDoSed by withdrawals in periods of high demand (i.e. bank runs). Presumably they mainly intend to serve exchanges which are doing withdrawals in the $millions. Not defending their other practices.