DNS, IP Address Reservation, Plan Upgrades, Bandwidth, and so on.
We've seen AWS accounts get broken into with stolen tokens, additional VPS's started, VPS upgraded, bandwidth consumed, etc. And while Amazon has been good with refunding the FIRST time, nobody wants to wake up to a 10K bill because your gitignore had a typo.
A ceiling or cap may even stop plan upgrades without an email confirmation. That would be hugely welcome, particularly in a world where bad guys are actively seeking out VPS to break into.
The only overage charge I see is for data transfer. This isn't ideal, I'll grant you, but it's not the same as "various".