Sorry, you're right, I should have been clearer. The bigger concern is that caching doesn't replace fault tolerance and rolling your own disaster recovery. I didn't mean to suggest that caching was not being done or would not be helpful. A million keys would be pretty uniformly dispersed; intuitively it seems like you'd need to have a lot more traffic than he's currently got to the point where caching reliably soaks enough load off of "a VPS or cheap dedicated server" that you can afford to have the server blow up--because servers blow up.
"A VPS or cheap dedicated server" is YOLO stuff. Not something you do when you want other people to rely on you.
You can set up 3 VPS and use Cloudflare's load balancing or a solution by someone like DigitalOcean? That'll still be cheaper than using Lambdas and block storage.
AFAIK caching already kicks in when people check different passwords that have same first five characters in their hash.