I imagine that the usual protections will deal with this (e.g. too many requests from the same ASN or same user agent or something). Then they can ask for a phone number or credit card (fly.io reluctantly did this). Then they can always remove the free tier, at this point the abusing party will have ruined yet another free platform for everyone.