Definitely, true. The purpose of the signature and allowed hosts functionality is there to help mitigate that risk. Also, since the image service would be run separate from the main application, it shouldn't impact the performance of your site. Likewise, in a real production environment, this would run behind a CDN or Varnish, the DOS would just prevent new images from being generated until it could be addressed.