As noted in other discussions, custom Actions do not help in this case as the token exchange is counted toward the quota regardless of the success or not, as was confirmed in a different thread that I am not allowed to link.
The silence of Auth0 on this matter is disappointing. We really need a cost cap on this feature to protect us from broken clients that we do not control.