For bandwidth, which is about the only thing that one’d worry about, Fly does (did?) send email alerts when they detect abnormally high usage. At least, I got them back in the day.
Also, Kurt did mention that Fly might refund for “mistakes” within reason: How concerned should I be about a surprise bill? - #9 by kurt
You can mitigate this with a rate-limiter in your code, or by proxying static assets through a CDN like Bunny / Cloudflare.
Other than (on-demand) Machines kept busy by DoS, I think bandwidth pricing is about it.