Nothing wrong with putting a link to a zip bomb in your robots.txt and disallowing them.

Also, just put a limit on requests per IP? https://nginx.org/en/docs/http/ngx_http_limit_req_module.htm...