Kind of — sometimes expensive routes are necessary (e.g. for operations interacting with passwords you will need to do cryptographic functions and the fact that they're compute intensive is a feature rather than a bug because that makes them take longer to brute-force).

Sometimes the solution there is to move expensive routes behind a login page (doesn't work for sign up/in pages of course.) If you can't do that (or even if you do) sometimes the solution is to stick a captcha on the page.

Depending on the system, sometimes the solution is to separate the expensive parts out into their own service so you can isolate failures — like if you're Netflix, you'd probably want the application responsible for streaming videos to be completely separate from the application responsible for logging users in, that way if your sign-ins go down the people who are already signed in can still watch their videos.