The worry about guest ordering is always the same: that the kitchen loses control of its own queue, or that a guest orders something to a room that never reaches their bill.
Both are configuration rather than fate. An order can land as pending acceptance so a waiter confirms it before it is fired, and it can land straight on the board where a property wants speed.
A room-service order opens a party against the room, and its charges reach the stay folio through the same posting path a restaurant bill uses — correctly taxed once, at the outlet.
Every write on the guest surface is throttled, because the surface is unauthenticated by design. The per-IP limit bounds what a photographed code can spend before the per-room caps take over.