Yeah, true, that may happen. Ideally you get a combined payment by hours with a bonus for performance. That is often a bit complex or tricky though.
You mitigate the risk of getting paid not enough in case the hours spiral out of control while still getting paid a lot when you outperform expectations.