This appears to be by design. People have been demanding a budget capping service [0] for a decade now. AWS would continue to bill for compromised accounts [1]. AWS "free" offerings can cost a lot more than you think [2].
[0] https://news.ycombinator.com/item?id=3356987