I ended up with a $700 bill for a month with Route 53 due to bogus DNS requests (a normal month would be like $5 or something). And there is nothing a professional engineer could do anything about it - except pay $3000/month for AWS Shield Advanced.
There was no misconfiguration, just millions of DNS requests but not millions of actual users. I was in contact with AWS support multiple times. The only solution was so use AWS Shield Advanced. They did refund most of the charges but it was too risky for me. Even after I moved DNS provider there was DNS requests to the R53 zones. I can highly recommend https://dnsimple.com though.
I'm guessing AWS refunded close to 100% of fees associated with provable bad DNS requests.
AWS did do a refund but it requires me to monitor usage and do some investigation. I really don't want to spend time monitoring DNS requests.