Bots should be able to temporarily/permanently block users. When a user is blocked by the bot, the bot won't receive any updates from the user.
A possible workaround is to temporarily "ban" the user when the flood is detected by setting a database record. On every incoming message, it needs to check (with cache) if the sender of the message is currently banned, and if so, ignore the user.
Users can send messages on telegram very quickly. A bot, even if it has antiflood code, may start lagging for everyone, just because a few users flood messages or inline button clicks and the bot can't cope with the updates anymore.