How Do You Handle Distributed Rate Limiting in APIs?

I've been a developer for a few years, mainly relying on frameworks and AWS to manage complexity. Recently, I'm diving deeper into system design for an API project and am confused about distributed rate limiting. I get the idea of Token Bucket algorithms—tokens added at a set rate, rejecting requests when the bucket is empty. However, with a distributed system of 5+ nodes behind a load balancer, isn't using a centralized Redis to store token counts risky due to potential race conditions? For instance, if two nodes get a request from the same user at the same time, they could both read one token left and allow the request, breaking the limit.

I've heard that using Redis Lua scripts can make the process atomic for reading and decrementing tokens, but doesn't this turn Redis into a single point of failure and a source of latency at scale? I've also come across mentions of Leaky Bucket systems, but they seem to reduce to basic FIFO queues in implementation. I've been looking through resources like the GitHub System Design Primer and watching videos on system design. For those working on APIs, do you actually write custom atomic Redis locks for rate limiting, or do you rely on built-in limits like those offered by API gateways or Nginx? Am I overthinking the importance of race conditions in rate limiting?