People aren't paying with their own money for DDoS machines normally. Well, maybe there are some small operations like that. But often the traffic comes from a hacked service that's a part of a bigger botnet. It may lead to a larger detection ratio on AWS/GCP, but the attackers are not paying the costs.
Attackers aren't paying with their money, but it's important for them to go undetected. If your bandwidth is a fixed cost (ie isn't related to your actual usage) you are much less likely to keep an eye on it than if it costs an arm and a leg.
