some types of DDoS. ;)

You could still overload the service with a sufficiently large attack in either volume of connection requests or number of unique IP addresses.

Token buckets are usually part of an overall resilience strategy rather than a silver bullet to solve all denial of service concerns.