I bet a big factor is that AWS and GCP charge obscene markups for bandwidth. Much harder to get away with.

Of course, no one could afford a ddos from AWS or GCP. Even in the case of compromised machines, the huge traffic bill is going to alert everyone pretty quickly.