The rate limit is happening on the server side.
The filename is not known to the backend, it’s encrypted too, include all prefixes. It become available on the client side, when you provided an encryption phrase to decrypt them, thus filenames cannot be used to rate limit.