So the decentralised system relies on you as a SPOF dealing with abuse and paying the bills?

Only in the short term. TheGraph is migrating from a centralised service to a decentralised network and the community can run alternative oauth servers to help mitigate attacks. I'm no cybersecurity specialist though.

Also, the data is always available on-chain and the protocol is open so other people can write an alternative ui with their own blockchain query capabilities. Like Bress.xyz does with Mirror.xyz.

Payments can be automated on-chain.