Geo Restrictions on the Cloudfront distribution and a WAF will go a long way in mitigating against abuse and unnecessary costs.
WAF also doesn't seem to be free, where did you read that?
"Is that how you want the web to generally work?"
My suggestions on ways to prevent paying for CloudFront charges from junk requests are not prescriptive. However, they are AWS best practices when dealing with DDoS.
https://aws.amazon.com/answers/networking/aws-ddos-attack-mi...
For example, if I want to purchase southwest airline tickets, I have to use a VPN.
Off-topic but interesting anyways, I've noticed that people who move from the US to elsewhere, often call themselves "expats", while people who move from elsewhere to the US, are called "immigrants". Why is that?
I think it depends on how you view the move. Expat (which in my experience I've heard more Brits use than anything else), implies that you still 'belong' to your home country but are choosing to live elsewhere for a (perhaps very long) while. Immigrant implies that you are leaving your old country with a view of 'belonging' to your new country.
Simplified slightly, if you ask someone where they're from and they answer "I'm from X, but living in Y" they are an expat. If they answer "I'm from Y, but was born in X" they're an immigrant.