Does someone know of theoretical worst case expenditure when using instances (e.g. EC2) to host some publicly accessible content? I mean instance cost itself can be estimated but what happens in case a malicious entity would start downloading at a rate, order of magnitudes higher than normal (for instance through a botnet). Outbound traffic is billed and cannot be controlled unless specifically implemented by the host - which is rarely the case, let's be honest. I guess at some point DDoS protection and the likes would kick in but that might also take a while. 

As I see it no cloud provider supports hard-budget limits (they willingly avoid it, in turn this means that it must cost customers a significant amount) so my question is, has anyone thought about this or even experienced such scenarios? Is there any technical protection from the cloud provider or is this entirely left to the user?

It's kind of odd that in CS we are always talking about worst-case complexity but apparently that doesn't apply to money...