Yes, but I guess what is limited is access to those resources from a site running on WP Engine servers. I also assume that users can download the themes from outside WP Engine and install them anyway.
The Subversion repositories with the code are also public. Anyone can use them. There is no restriction of freedom by restricting access to such a repository, if the code is still publicly available.
This way WP Engine still has the opportunity to mount its plugin and theme repositories, without taking abusive advantage of the WordPress repository infrastructure.
There is work, energy consumption and so on behind it. Expenses that WP Engine is not taking on and does not even want to compensate for.
Automattic's reaction may seem like overkill, but it's a clear and forceful wake-up call to companies that are out to parasite their work and infrastructure. They do it because they have a privileged position. I think they are right to do so.
This does not mean that somebody could criticize a possible lack of consistency when Automattic is the company that adopts abusive attitudes towards third parties.
I think the real problem is that Automattic did not plan for another company to get this volume of customers using WordPress, creating a burden on WordPress servers that is not compensated for.
What they should have done is set limits or payment plans above a certain volume of connections or transfers from a person's or company's servers.
The problem is to act in this way, suddenly, apparently without foresight and that the possible problems will have to be borne mainly by WP Engine users.