This a genius move tbh.

Offer to host badly (vibe)coded apps and then offer CF WAF to protect it from attacks.

Also see https://www.npmjs.com/package/@cloudflare/sandbox

I am keen to understand how I would limit sandbox resource usage.

Interesting, Vercel also just introduced "Sandbox" [1], which is a very similar concept, and also for node.js.

I wonder if they were looking at each other while developing this.

1: https://vercel.com/docs/vercel-sandbox