It’s pretty much table stakes to block or restrict or just investigate more closely if requests come from an IP address in a data centre provider or VPN provider ASN though.

I worked at a cloud company a while ago, and if free tier user requests came from another cloud providers IPs we’d have to double check it wasn’t fraud since that happened more often than residential ranges.