The site user/admin saying "If this spend goes over $100, shut shit down" is called being a fiscally responsible adult.

The fact that most cloud operators don't have actual hard cutoffs to maintain financial responsibility is intentional. Azure does, but only for specific account types. If it's PAYG, you can't do it. The end result is if you do something "weird", or someone DDoS's you, you're liable.

With a hard limit, a DDoS just takes your site offline.