Every system has limits. If one request, or many, can make a server consume far more memory or processing time than it should, the server slows down or fails, and other users are affected. This is the core of many denial of service attacks, and it does not need a large botnet when a single small request is expensive to handle.
Resource exhaustion also happens by accident, for example from a runaway query, a memory leak or a loop. It can be a side effect of other attacks as well, such as a flood of oversized uploads.
The defenses come in layers: set limits on input size, field counts and nesting; set timeouts; cap memory and CPU per process; limit concurrent connections per client; and spread the load. Monitoring tells you when a limit is being approached.
When a vendor advises a limit as a mitigation, it often aims to keep a flaw from exhausting a resource or corrupting memory. Check your monitoring for memory spikes and worker restarts, because exhaustion often shows up there first.