Two different questions about the same caller
A resource quota caps the total amount of some resource a principal may consume over a defined period — total storage, total compute time, total records processed — independent of how that consumption happens to be distributed across individual requests during the period. This is a genuinely distinct control from a rate limit, which bounds how frequently a caller may act: a caller can stay comfortably within any reasonable rate limit while still exhausting a resource quota through sustained, unhurried, entirely ordinary-looking use spread out over time.
Because the two controls address different failure modes, a system with only a rate limit and no quota is exposed to slow, steady resource exhaustion that never trips any frequency threshold, and a system with only a quota and no rate limit is exposed to a rapid burst that could overwhelm the system in the moment, well before the quota itself is anywhere close to being reached.
Sizing quotas around actual, legitimate use
A quota set too generously fails to actually bound the risk it was meant to address; one set too tightly disrupts entirely legitimate, heavier-than-typical use cases that never posed any real problem. Getting this right generally requires understanding the actual distribution of legitimate consumption first, rather than picking a number that merely feels appropriately conservative in the abstract.