Against what, exactly, does this protect? And why?

"Bad bots" are the least of my worries, and if I were to protect against anything, I'd protect agains excessive requests per second.