This may be a stupid question but I’ll ask anyway, is it possible that someone installs my app and over-uses the cloud service (e.g. by using a bot), skyrocketing the cost?
It depends on the app. If you can upload a huge amount of data (like videos or images) and someone makes a bot to spam you then it can easily overuse the cloud.
The question, then is, do you have any spam protections?
With my app it’s not possible to upload huge amounts of data, but still…
You can build one. Limit the user upload, or make that feature remotely disable.
The true question is, why anybody wants to do that. If you don’t give any benefits based on the usage, then you will be fine. Nobody will write bots like that.
Somebody who has a grudge against me, for example?