That is correct, you can only have 4 subscription handlers. However the eventName string is a prefix - it will match every string that beings with that string, so the usual workaround is to name your events carefully so you can catch all of your events with a single subscription handler.
Another method is to include more information in the data that differentiates what the event is, to reduce the need for separate events.
When you want to publish events to a single device, common technique is to prefix the event name with the deviceID (hex string) of the destination. The device subscribes to that event, and you can also suffix stuff after the deviceID to further differentiate the event.
You could register and unregister handlers, but it’s not very efficient and you could possibly lose events while you were not subscribed, because they’re not queued in the cloud.
The only limitation on publish is that the average cannot exceed 1 event per second. You can burst out 4 events quickly, but then you can’t send any more for 4 seconds. Or you can constantly send out 1 event every second.
That’s per published event, If multiple devices were publishing to a subscription handler it could end up receiving more than 1 event per second.