There is a nice button on each instance that turns off new registrations. Once an instance owner has enough users and don’t want to upgrade the instance anymore, he checks that one.
It will be impossible to ddos every Lemmy instance, not very efficiently at least. Now it’s super easy to just bomb Lemmy.world.