Do API Gateway 429 return codes count against request quota

I'm using usage plans to rate limit the requests against an API Gateway on a per user/API key basis. When a user makes too many requests, eg, more than 100 requests/sec, they'll receive a 429 return code. My question is whether these requests still count against the quota of the API Gateway of 10k requests/sec.

Framed differently, can usage plans protect against against a bad/malicious user that issues 10s of thousands of requests and keep the API available for other users?