No one is going to be bankrupted over a $6500 AWS bill. I did a major F-up a few years, letting a key get pushed to a public repo, resulting in instant pwnage and $50k in charges from AWS due to crypto miners being launched. We communicated to AWS, did some work on our part to demonstrate that we put in proper safeguards and auditing, and they removed the charges.
They already talked to AWS and had the bill cut down to ~1800 dollars from ~6300, but they legitimately launched those processes instead of having the key stolen so the cost reduction is understandably less generous in those situations. Also potentially the agent was able to connect to more open networks and might have been running jobs on them incurring legitimate costs.