I think you're missing the point. Limiting the number of PRs, but not counting draft PRs, just means the SPAM PRs will all be drafts. This solves (almost) nothing.

> Or using it correctly...

Note that people using AI to make spam pull requests are not using the system correctly.