How though? Can you also avoid DDoS simply by designing your system to not care if the requester is a bot or not.

Let's say I'm running https://grep.app/ for example. AI bots start heavily using it, costing me a ton of money. How would you magically design this so it doesn't matter if the end bots are using it?

Rate limit individual clients.