They kinda are. DDoS protection is only viable at massive scale, but is table stakes for any website with content that someone out there might find objectionable.

Then when would they become one?