>> Don't lots of smaller hosting providers have DDoS protection?

It is pointless if you have a small pipe. Pipe jamming attacks are way too common and small vendors are almost always unable to cope with that.