A malicious user that manages to break out of the container environment will only have access to other instances of their own applications. Stronger security policies exist between users.
In terms of DOS'ing our services, we limit disk space usage per job, and are working on bandwidth limitations (this is a weakness, but for now we'll just ban abusers and work with those with legit needs)
Or things like using stolen credit cards to do Bitcoin mining.
We have plans but ultimately won't really know until we're in the thick of it.
Our plans though are to limit bandwidth and ban abusers. We'll work with Stripe's Radar platform to reduce the stolen credit card fraud.