Presumably the costs for a platform are passed on to the platform's customers from that platform's cloud provider (with profit). When a spike happens due to, say, a DDOS, does the platform first have to negotiate with the cloud provider to waive the cost?

Presumably the costs for a cloud provider are passed on to the cloud provider's customers from that cloud provider's operating costs (with profit). When a spike happens due to, say, a DDOS, does the cloud provider first have to negotiate with its downstream suppliers (e.g., energy, network peering, etc.) to waive the cost?

...

How far down the chain does this go? Or maybe insurance steps in at some point -- or every point -- to break the chain?