Rate limiters can be added as a first layer of security to filter out malicious traffic and prevent Ddos attacks on the main system. But since rate limiter itself is an application with resource constraints, can a Ddos attack bring down the rate limiter itself.

In such a scenario i assume rate limiter itself wont be able to serve requests to the main application. How would such a scenario be handled in a real world application