For per-use cost, the layer I'd add sits between your device signature and the global cap: what kind of network the request comes from.

Part of it is free on Workers already. request.cf.asn and request.cf.asOrganization tell you when a "visitor" is a cloud provider, and those guests could get zero free generations instead of the normal allowance. That catches the lazy scripts at no cost.

It won't catch residential proxies or VPNs, which is how someone walks around per-IP limits. That needs an IP reputation lookup, called only on the generate path. We sell one (disclosure: I work at IPGeolocation.io). It's a paid feature and it means sending the IP to a third party, which you'd want in your privacy note, so it only makes sense once abuse costs you more than the plan: https://ipgeolocation.io/ip-security-api.html

On Praneet's question, I'm curious too: when the global cap hits mid-day, do new visitors get "come back tomorrow" or a nudge to sign up?