Given the limits I was thinking, not whitelists but time, request, and complexity limits, I don't see a huge difference.

Theoretically it does sound more dangerous, particularly for a free service, but you'll have to be careful either way, no getting around it.