Do people but debounces on every remote so that they cannot be spammed?

I heard that exploiters could spam remotes causing the remote to be exhausted

I don't really know what happens if the remote is exhausted but

I've heard they don't work or fire

Does everyone put debounces for remotes so they cannot be spammed for every remote?

Exhaustion means when you send data to the event but nothing is taking it out, it'll eventually all queue up and be removed. As for debounces I don't think so, as long as you validate your input on the server to make sure the user is allowed to call the event it should be fine.