Same symptom, different question
A rate limiter answers 'is this caller acting too frequently,' regardless of whether any individual call it's making is one it should be allowed to make. An authorization check answers the opposite question: is this specific action, right now, permitted for this identity — independent of how often it has called recently. A caller can fail either check and receive what looks, from the outside, like the same rejected response.
Treating a generous rate limit as evidence that access is under control is a mistake in exactly the cases that matter: an attacker who has obtained legitimate-looking credentials does not need a high request rate to do damage, only the right single request.
Why the confusion is easy to make
Rate limiting is often the first defensive control teams add, because it is comparatively simple to implement and immediately visible in a dashboard as blocked requests. That visibility can create a false sense that abuse is being handled, when what has actually been handled is only one narrow category of abuse — high-volume, low-sophistication attempts — while a single well-targeted unauthorized request sails through untouched.