I believe that cloud providers should make hard spending caps the default: when you hit your limit, everything stops, rather than you getting a warning email you only see after the damage.
The reason is simple: coding agents can now ship code that burns through paid APIs while you sleep.