I don't think I've ever seen an official limit like there are for the full-size PCIe slots (and it doesn't help that PCI-SIG keeps everything behind a paywall).

I don't think I've ever seen an official limit like there are for the full-size PCIe slots (and it doesn't help that PCI-SIG keeps everything behind a paywall). Open Compute Project's Datacenter SSD Specification calls for average power to be no more than 8.25W for M.2 22x110mm drives, so that's a soft limit of what server vendors are designing for. IIRC beyond about 15W sustained both thermal dissipation and power delivery/voltage regulation are a real problem (3.3V with 5% regulation isn't so easy when you're pushing close to 5A through a tiny connector, though apparently M-keyed slots can provide a few extra power pins). Prior to PCIe gen4, it was the enterprise SSD market that was really pushing M.2 power, and they were quite eager to abandon M.2 in favor of form factors that provided a 12V supply.