Akismet is a paid service and their apis are tailored for comments. An advantage with comments is that you can just mark as spam if some contents have dubious links or keywords.
An issue you have in many forms (e.g.: login form) is that there is limited data to decide if it's a real user or a bot.
Depending on the app might not have better performance. The reason is that a host with more connections might not be using more resources than one with less connections. The busy connections might be waiting for a reply from an external service.
There a lot of ways to reduce, just some ideias: turn on 3dsecure authentication whenever available. Check user location vs card location. Validate cvc code and postal code. Check for user activity and user signals (user agent, screen size etc) on the website, and other methods.
Would be interesting to study if there is a correlation between layoffs and remote work and employee churn. It's easier to layoff people if you don't have a connection with them.
They workout the issues like everyone else, and at a certain size the issue is minimized as you are either in several whitelists or human moderators recognise your domain.
Most of those services also let clients setup their own domain name, so a ban is a more of a inconvenience to deal, than business critical like in OP case.
I don't have a specific solution for you, but I also run a domain with some thousands of subdomains and is always a fight to not be banned from Google, Meta, internet operators etc. Sometimes is enough one bad actor under one of your subdomains to have a full ban on the whole domain.
What I suggest is for your and your clients to contact Meta through the Business Center support. Their support for paying clients is much better. I would also recommend you become a Meta Business Partner if Facebook/Instagram is important for your SaaS.
I think that's one of the reasons, but the main one is economical.
For a long time they dealt with the free accounts, so in a way they have already a lot of protections in place, and if they wanted they could keep the existing free accounts and just not accept further signups for this account type.
If you need to access the client IPs for several reasons (throttling, analytics, security etc), be aware that AWS Global Accelerator still only supports IP preservation in some specific setups: https://docs.aws.amazon.com/global-accelerator/latest/dg/pre...
There are a lot of options in e-commerce, all of them with thousands of shops: WooCommerce, Magento, Jumpseller, Bigcommerce, Prestashop, Wix WooCommerce etc...
In small business stores most users checkout as guests, so the website only has enough info to provide a shipping estimate after they have your address.