Serverless is the problem in that most serverless services don't let you hard-cap spend.

This issue is serverless-specific. If I pay $20/month on VPN the most frightening thing that can happen is the client calling you about your website being down, not a $100k bill.