No. The flexible request header is parsed on the broker network thread before authorization, request dispatch, and request-time quota accounting.
An attacker needs to be able to send a crafted request to a broker. Because parsing occurs before authorization, the attack can be triggered before the broker evaluates client permissions.
Flexible protocol requests using header version 2 are affected, including flexible APIs such as ApiVersions v3. The tagged-field handling applies to the request header itself, not only to fields in the request body.
Unknown tagged fields can be encoded using as little as two bytes each, while the declared count was not checked against remaining buffer bytes or capped. A request of a few tens of megabytes can declare about 20 million fields and cause approximately that many RawTaggedField allocations.