Even if AWS had a hard spending limit, if an attacker has your root credentials, couldn't they still just increase the limits?