Yep, this is key. If you’re getting a bunch of malicious traffic from one source, that’s easily fixed. Just drop the traffic.
But when that traffic is coming from hundreds or thousands of sources, that becomes much harder to address. Can you just drop traffic from those sources? Sure! But then you also risk dropping legitimate traffic.
There are also services that can automate the detection and prevention of DDOS attacks such as CloudFlare and Akamai, but these can get expensive very quickly, so it can significantly increase the cost to running the instance in question.