Read-only access can still be allowed. I suspect the "violation of ToS" is simply privacy - they don't want to serve traffic to someone they can't stalk.
Read-only access would still be enough to launch DDOS attacks. I've never heard of any social media service offering read-only access to logged in users.
> I've never heard of any social media service offering read-only access to logged in users.
Twitter allows read-only access even to suspended accounts as well as when you go over certain rate-limits (I believe there was a daily tweet limit at one point, not sure if still there).