Budget alerts are postcards, not stop-signs.
GCP budget alerts are informational — emails after the fact. They have never been able to cap usage. A leaked API key, a runaway Cloud Run scaling event, a $7 budget test that compounds overnight to $72,000 — none of those are stopped by an alert.