I really appreciate Twilio's features that limit unexpected costs. I have a personal Twilio account I use to tinker, and to run a simple phone system for my small business, and I would be super worried about doing that if it was like AWS where the best I could get was alerts. Instead Twilio let's me charge my account upfront and disables it if I hit that cap. It's great peace of mind for smaller users.

Is there any way to contain or firewall the SIMs such that they only have access to specific networks? That seems like the holy grail of avoiding people buying IoT devices for their SIM (e.g. what happened with early kindles and many other devices).

Great question! Super SIM has a feature called Network Access Profiles that lets you pick exactly which cellular networks you want your devices to be able to connect to. A lot of other cellular solutions, Twilio’s other cellular connectivity solution included, give you really rudimentary control such as do you want access to the United States (yes/no) and do you want the rest of the world (yes/no). Network Access Profiles lets you pick exactly which countries and which networks inside those countries you can connect to so you can build access just the networks that you want to.

What I mean more is, once those devices are connected to "the network" is there a way to limit the usage of those SIMs so they could only connect to my systems, and not connect to "the internet" at large.

Seems like that's something you would design into the device itself (or rather, its software), whitelisting allowed domains or IPs.

I've done exactly this before when building an IoT device.