Hello and thanks for reading.

Going serverless is great for scalability, but also for all the boring part of system administration (patching, OS update, network set up, backup and redundancy,…). Serveless saves a lot of human toil (and cost!)

Your 2 questions are very interesting. In summary

1. DDoS: If you deploy your Cloud Run or Cloud Function in private mode (I mean you have to be authenticated to reach the service) or if you protect your App Engine with IAP, you have nothing to do! The traffic and the security checks are performed on Google Front End. You pay nothing and you are protected!
   If you deploy in public mode (I mean all unauthenticated users can access to your API, or you choose to not use Google Authentication method but your own authentication method), there is nothing today. A new feature will come soon and you will be able to plug Cloud Armor on it to protect your services
2. About the limit, you have 2 solutions. You can set a max instances on Cloud Run, Cloud Function and App Engine and thus limit the maximum number of instances. You can also checkout my article on Cloud Endpoint and rate limit that you can set up on your APIs.

Hope this help you to be more confident in the serverless solution!