I am thinking cents per some small usage unit, refundable for operating per sites terms.

That convention, implemented well to distribute & decentralize spike impacts, would force any direct overuse attack to take on significant financial risk. While essentially not costing anyone else.

It might still be damaging to availability, but as a service provider I would rather get paid handsomely for periods of being too overwhelmed to service my legitimate customers than not.

The main benefit is having machine interfaces, but those kinds of attacks being heavily disincentivized.