CPU isn't cheap, typical PHP+MySQl pages are ridiculously heavy, that's why Cloudflare got themselves into business.

Usually DoS attack doesn't exhaust the bandwidth, come on..