They also care because in practice such use is often done by attackers unbeknownst to the person paying for the resources. That would much rather make the person paying aware ASAP of such usage, rather than have them be on the hook for a large bill at the end of the month. Google does have a complicated process to allow cryptomining on their infrastructure. They also flag all kinds of other suspicious activity, eg once somebody was launching DOS attack from cocalc on “the country of Turkey” and that got some of cocalc shutoff immediately.
