A DoS attack does not steal data. It aims to stop your service from answering. The blunt version is a flood of traffic. The quieter version targets the application itself: one expensive request repeated in a loop, such as a search with no limit, a huge file upload, a report that scans a whole table, or an endpoint that calls a paid AI model.
For small apps the application-level kind matters most. Serverless hosting will often absorb a traffic spike, but it bills you for it, and a database with a small connection limit falls over long before the web tier does. An unprotected endpoint that calls a paid API can run up cost rather than downtime, which hurts in a different way.
Put rate limits on every public endpoint, and stricter ones on login, signup, search and anything that costs money per call. Cap request body size, page size and query time. Require sign-in for expensive operations, set spending limits with your providers, and keep your site behind a CDN or a provider that offers DDoS protection.