This paper provides a comprehensive survey of model extraction attacks (MEAs) arising from the proliferation of machine learning-as-a-service (MLaaS) platforms. While MLaaS platforms have increased accessibility to advanced ML models through user-friendly APIs, they have also increased the risk of MEAs, which replicate model functionality. This paper presents a taxonomy of MEAs, analyzes various attack techniques and defense strategies, and highlights the limitations of existing defenses and the tradeoffs between model utility and security. Furthermore, we evaluate MEAs in various computing environments and discuss their technical, ethical, legal, and social implications, as well as future research directions. Finally, we provide an online repository of continuously updated related literature.