Having a CDN like cloudflare helps but it’s not foolproof.
For instance:
When a user wants to use a site that has a CDN the data request is directed to the server that’s on the CDN closest to the user’s IP location.
If a hacker had a list of the various IP ranges per each location ((they)) could IP filter out all of the CDN IP addresses which would overwhelm the host to cdn server as the request would bounce around.
But I’m just ‘an idiot’ so what do I know..