Attackers request /products/<random-id> with IDs that do not exist. Every request misses the cache and hits the database. What is the simplest cache-side fix?

Cache a 'not found' marker for missing IDs, with a short TTL. This problem is called cache penetration: the cache never stores anything for IDs that do not exist, so every request goes to the database. A short-lived negative result catches repeated requests. A Bloom filter of valid IDs can also block random ones. (A Bloom filter is a small structure that quickly tells you an ID is definitely not in a set.)

"Increase the TTL on existing products" and "Switch to allkeys-lfu eviction" do nothing here, because these keys are never cached in the first place.