You could do different levels of protection. Have a smaller tier for smaller companies (less than a million revenue a year) for maybe 500 or 1000 a year, then larger companies pay a more. If you get one of these lawsuits, do what cloud flare have "I'm under attack" style join.