Paying for what your users use, with no way to say no to the traffic, is exactly why billion dollar companies like Cloudflare exist - to protect people from "paying for what you use".

So yes, it is shady not to protect customers from that IMO.