The "Heroku-style free" tier is likely to be all I can manage for the short to medium term future, due to a variety of factors.

As a result, the two go-to systems I would turn to if I need code hosting are Heroku and OpenShift, and I have accounts with these platforms (although I'm leaning toward the latter lately). I am yet to do anything generally interesting with them myself, but these are the systems I take into account when talking to others, because I have no experience with GCP. (I wonder if this is true for others too, and how big that number is.)

I have zero idea how Heroku are fending off precisely what you refer to. I've heard about situations where individuals' AWS accounts have been hacked by automated systems that spin up "instances with everything", but once it was established with billing that the account was hacked, the charges (which in one case were 5 figures) were fully reversed. Perhaps this fact is relevant here.

I think the problem can be solved before it (theoretically) gets to that point, however.

Serving up webpages, doing the occasional database transaction, etc, produces a significantly different CPU load than bitcoin mining does. I don't consider instance CPU usage monitoring a violation of my privacy, so I think it would be perfectly fair to throttle back continuous high CPU usage, but allow for short bursts of high usage. (In fact, I think this kind of thing is already standard...?) For bonus points, make the system track instance CPU usage and adjust its thresholds to allow for periodic high burst usage :P (since, thinking about it, masquerading as a web server and doing 30 seconds of mining every 5 hours is going to work out to zero gain).

I wouldn't consider it at all unfair to offer a free tier with exceptionally aggressive CPU-time QoS; in fact, it would probably suit me (and a lot of other people) perfectly, giving the funemployed community the option to do things like spin up fascinating new environments like Erlang, Dart, Rust, etc, and play with these environments (which are not yet available on Google's cloud hosting infrastructure) for web serving and similar. (For more bonus points, I'd extend the heuristic CPU-time tracking I mentioned before to classify instances as "friendly" over the long term, and let them have exceptionally low latency! :D)

In short, there's a whole demographic of people out there that you're definitely excluding, including people like myself who are just at the "messing around" stage, to nervous types who don't like deadlines and run from the "free for X period of time" part of GCP.

I realize and recognize that your response here is only your opinion, not Google's, and I'm very happy to respond here or via email (my address is in my profile) if you'd like to discuss any of any of the things I've said. ^^