It's a good idea to limit it somewhere so you don't end up sending 10 MB every time it's fetched. The feed will be re-fetched to check for updates so the cost isn't paid just once.
It is paid only once since that 10 MiB gets cached by the reader. In future fetches the reader asks for entries newer than the date it last checked which means that the items already requested won't be sent again.
My understanding was that most feed endpoints just sent the whole thing back each time, or nothing (304 Not Modified, when conditional headers are included). This allows server and CDN caching of the response.