A severe enough bill can cause an organization to be instantly bankrupt. No opportunity to try to do something like caps. Regardless, turning on spending caps

A severe enough bill can cause an organization to be instantly bankrupt. No opportunity to try to do something like caps. Regardless, turning on spending caps isn't a final solution to this particular attack. With caps the site/resources will hit the cap and go offline. Accomplishing what a DDoS generally tries to accomplish anyway. The only real solution is that you have to have a cheap way to filter out the attacking requests.