It's also one of the single most abused platforms for malware command control hosting. I've spent the better part of a decade chasing down state based actors and crimeware actors who have abused Heroku's free tier. Heroku's abuse efforts cannot be cheap.