Oh, wow. I am always somewhat worried about the uncontrolled costs when deploying my personal projects to any cloud. I would freak out if I saw an invoice like this. This is why I like rate limiting stuff, authenticating the users before using any significant resources, etc. But, eventually there is always a risk of a kind of "DDoS", I guess. And there isn't even anything malevolent here.
I wonder if other cloud providers (GCS on GCP, Backblaze, etc.) bill similarly.