What happens if someone sends requests that look like to be OpenCode, but from Pi? What is stopping people from doing it? And how these measures are going to benefit Figma? I don't get it.

I guess this is in violation of the ToS on your account and can get your account closed? At least, that's how I imagine it would work.