Is there any risk? Don't the model providers also bill by the token?

The accounting could be asynchronous, so you could overshoot your budget by a few requests before you're blocked.