The danger isn't in getting hit with broadcasts at 1Hz or even 10Hz, 24/7, because nobody will notice that. It is whether you are happy to have your product more or less hang if some other bit of kit on the LAN has a bug and starts emitting broadcasts at 10kHz.
The average customer will probably not have the on site capability to discover what is going on.
The solution, as already mentioned, is to either poll the ETH RX, or use interrupts for ETH RX
and have a scheme for backing off the IRQ enable according to some rule (which is a bit of work, especially as you need to actually test it

).
In the embedded world, actually very few products need 100mbps data rates. We are not building routers (which are mostly linux boxes nowadays, with fairly decent CPUs). I bet you most embedded (IOT) stuff would be just fine with 1mbps. I am polling at 100Hz and getting 2.5mbps.
If you put your IOT on an open port, you will be getting login attempts (dictionary attacks) at 1Hz-5Hz
