In an ideal world, you'd split these up:

1. there'd be a currency steering committee (with some structure whose ideal form is above my pay-grade) that produces a machine-readable validity ruleset (sort of like a DTD or XML Schema);

2. and then there'd be a proliferation of competing clients that all know how to parse those rulesets, and use them to validate blocks; but which otherwise go about their business of being Bitcoin clients in entirely separate ways.

With such a split, issues with the management of "BitcoinCore the FOSS reference client implementation" wouldn't overlap with issues with "Bitcoin, the ruleset that, in being instantiated in a majority of nodes, gives them a consensus chain." Instead, the first would just be a regular code project, no longer at-all critical; and the second would be something more like the project of defining a new version of e.g. the ePub standard, or of drafting an RFC.

Bitcoin nodes get DDOSed from time to time-- e.g. people incorrectly believe they're the node for some service they think they can extort. Sometimes users on bufferbloat afflicted connections mistake other users fetching the chain from them as a DOS attack.

That said, since these claims that people are DDOSing "Bitcoin classic" were first made, I've had someone running a classic node-- in the hope of identifying the attacker-- which has received no attacks. I don't believe the claimed attacks are widespread if they're even happening at all.