> I wonder if the author is going to be on the hook for the bill for this.

Almost certainly not. I've seen AWS reverse charges even when it's unequivocally the user's fault rather than someone hacking in.

As an example, I launched two reserved instances outside of a VPC when I meant to launch inside a VPC. At the time, this couldn't be changed, and the docs were very clear on that. After filing a support ticket, they reversed the reservations... and gave me a $100 AWS credit. For my fuck-up.