You don't mean literally distributed denial of service attack, right? It's super easy to keep serving a static resource, so I think you'd need a huge amount of traffic to put a dent in Firebase's static hosting capacity.

I've had spikes of up to 300k visitors to my Firebase blog in a month, and the bill was like $150. It seems hard to get bitten by huge surprise costs from a blog on Firebase static hosting, even if someone's using a botnet to try to drive up your bill.

Edit: Thinking about it a little more, I guess you could find the largest resource on a blog and direct your botnet to download it nonstop repeatedly, and that would be orders of magnitude more expensive than even large organic traffic.