Earlier quoted context omitted.
> So a bot net could absolutely wreck your credit card by just repeatedly trying to access your API with invalid credentials. You could argue that for pretty much anything being hosted, anywhere.
No, because most self-hosted services are 10-20x cheaper than comparable SaaS offerings. In the realtime space Firebase is particularly known for being really expensive for the scalable plans (blaze plan).
This has nothing to do with the fact that it could be hit by a botnet, as per the exact point I commented on, could 'wreck your card', it's simply a question of scale.