Just linking to rxxxit doesn’t require the API, so no API costs.
There is no flood warning because the individual lemmy user viewing the linked content uses their own IP address.
i.reddit is a web server just like any other and if you have a link to a file there, and it is not otherwise secured, you can embed a link or reference to it in any HTML.
You don’t realize this likely because you browse using a mobile app and imagine that reddit is something other than just a website that can be treated and linked to like any other website.