The free and $20 plan doesn't cover all DDoS attacks. The real stuff costs more than I spend on my entire monthly infrastructure. For my use case, it would cost $6000/mo (I need wildcards and full DDoS mitigation). I'm sure $6k is cheap for someone, but it's not cheap for us.
Meanwhile, providers like OVH, Ramnode, Vultr and BuyVM offer various levels of integrated DDoS protection for their servers and VPS for free or a very reasonable cost ($5-10 per month). It's out there, you just need to look for it.
Genuinely curious: How reliable are the DDoS protection services offered by these cheap providers?
BuyVM promises 500Gbps protection for $3/mo, whereas Vultr offers only 10Gbps protection for $10/mo. The pricing is all over the place. I would naturally assume that the quality is all over the place, too.
OVH will nullroute you in about 3 seconds if you're affecting the stability of their network. I've been hit with a very large DDoS attack before, and our host nullrouted us because the attack was causing instability for our neighbors in the rack due to the switch being flooded with too much traffic.
How long ago was this? From what I've read it seems this used to be the case, but they got their act together about it within the last couple of years. On their site they claim to offer DDoS protection bundled with their VPS offerings:
Meanwhile, providers like OVH, Ramnode, Vultr and BuyVM offer various levels of integrated DDoS protection for their servers and VPS for free or a very reasonable cost ($5-10 per month). It's out there, you just need to look for it.