Consider an Arweave website to stop DDoS without Cloudflare and censorship resistance for Monero binaries, https://simplifiedprivacy.com/arweave/Arweave-QA/index.html
We're talking about the same thing, just the links need to be fixed to work without nginx. We can help for free or limited cost, reach out on matrix
You're correct about that being an issue, there's 3 responses:
First, the person can flip to airplane mode in their home. It's possible to be actively targeted by an attack, but this is unlikely if you're a random IMEI
second, the person could be renting through a friend or cash via landlord. or in a highly populated city
third, if you're that concerned, then do hotspots or GLiNET with external sim, and then the person would want to avoid the main phone in their name anyway, to avoid the attacks mentioned in the first one