>because whatever alternative is suggested (hidden form elements, a random VPS provider with DDoS mitigation, serving assets locally, etc.) is immediately dismissed as "that can't possibly be as effective / effective enough", even though it'd be perfectly adequate for the vast majority of cases.

They are immediately dismissed because I don't want to pay a fulltime engineer to play cat and mouse with skiddies on the internet.