I think relays should look into blocking events that look weird, even though they do not infringe any NIP. for example, I just saw a "like" event that referenced a single event and 10 different pubkeys. I would have expected these likes to not mention more than 1 (or perhaps 2) pubkeys. of course others can disagree with me, but that's the beauty of custom relay policies.
Discussion
another example is relays blocking duplicated reactions (from the the same pubkey to the same event). these things don't need to be specified in NIPs (although they can be recommended) but common sense can inform their application.