I got $10K GCP bill one month because of ClaudeBot. Its likely some users were trying to replicate our software by using Claude code + chrome plugin. If I was spending $10K on traffic, I can only imagine the money cloners must be spending on tokens.

Well, potentially very little! It could be subscription usage, or just really inefficient code authored by an agent. It probably costs LESS in tokens to write a poor quality cloner that breaks upstream things.