Those companies can afford letting people try "Denial of Wallet" attacks on them, though.

I, for one, will still keep using VPNs as an additional layer of security and expose only a single UDP port (WireGuard), to at least reduce the chances of that happening.