I think the point is that this attack vector can be pretty anonymous and absolutely deadly to the target company.

This attack is also not protected by insurance, like someone setting fire to your office would be.

It’s fair to explore just how vulnerable a company can be to this type of attack from a malicious competitor.

It's a weak point.

You can also pull API keys from most apps and get them banned from advertising networks.

You can hire people to review bomb.

Hire people to make fake news about a competitor go viral.

Someone willing to do illegal things can always hire other people to do illegal things for them "anonymously"

You’d need to come close to 1% in total charges. That’s roughly what Visa and MasterCard set as limits. This would work with anyone who accepts credit cards, not just Stripe customers.

Assuming their a competitor 1% seems like a small tax to pay to gain the entire market share.

You probably don't gain the entire market share even if the attack succeeds in leaving them permanently without a payment gateway, except in situations where the answer to "who is attacking us?" is fairly obvious...

Risk is relative thing the activity has to cross threshold for the appropriate gov entity to investigate and since they are swamped that threshold keeps going up.