Most people don't get DDOSed, and for many of the ones that do, they can just wait it out until the attacker gets tired of burning money. It's very costly and risky for the attacker. Obviously they do occur sometimes - so does murder - but Cloudflare is massively exaggerating the risk of drive-by shootings to make you buy their bulletproof vests.