I think it should be noted that this happens when not configuring things right.

By default, security rules are on, but I can disable security rules programmatically for a hostname too.

fwiw, I once got a ddos on a host running their pages product, and got no charge for it. it also stayed up and didn't give captcha pages