Cyber attacks in the OSM space

I don’t think so. Every “save” to the API gets transferred, checked and accepted or rejected. If it should be more complex it would be partly rejected.
Each save would be one changeset, but you couldalso cache the edit until the changeset gets closed and perform the check afterwards. For sure, the editors will need to understand the results of the checking and inform the user. Though that would be nothing specific the API needs to consider.