The census fiasco was a truly special kind of incompetence. The best inside analysis was from the folks behind the Risky Business infosec podcast:

https://risky.biz/censusfail/

Summary: The project was outsourced to IBM (that alone probably says it all), who didn't purchase any DDoS protection. A small attack crashed the first firewall, and the backup firewall didn't have rules loaded. That caused IBM's monitoring tools to flag system logs as exfiltration, so they called in the Australian Signals Directorate (ie national security) and turned everything off until intelligence agencies completed an investigation of the false positive.

All the marketing calling it "Census night" and encouraging people to do it on the same evening instead of over the week probably didn't help spreading the load out.

Furthermore, although it's true that IBM didn't purchase DDOS protection, neither did the government pay them to purchase it. IBM is incompetent but in this particular case I can't blame them for attempting to make a meager profit out of the pittance the Australian government chose to spend on their first act of digital governance.

There are plenty of projects that don't have this issue. It's not "always", just the big ones so it seems like it's all of them if you don't know about the others.