Tbh there's a much easier way than soft forks. Node operators (RPC nodes), which are the true gateway between the interfaces and the blocks, can easily implement a filter to block accounts which cause heavy load (higher than average cost, spammers, attackers).

That type of "blacklist" can be maintained without need for a softfork. And even be implemented by multiple node operators as well.