The general issue is that a regular low-level Solidity call, ie
<address>.call(), will automatically copy all bytes returned by the callee to memory.
Note that using memory during an EVM execution costs gas, more specifically you pay gas whenever the memory is expanded.
A possible DOS vector a caller therefore needs to take into account before calling an unknown contract is a returnbomb attack which can lead to the caller running out of gas and the execution to halt.
During such an attack, the callee returns such a big amount of return data that the caller runs out of gas while copying the data into memory.
To prevent such an attack, the caller can use yul/assembly to explicitly decide how much data should be copied to memory.
For more info you may read into
nomad-xyz's ExcessivelySafeCall project.
EDIT: To execute such an attack in a local environment, see pcaversaccio's ReturnBombExample.sol gist.