> The problem with this logic is that ordinary users don't become the target of a denial of service attack either

I suspect the concern is not that ordinary users would be targets, but that ordinary users would be sources of ddoses (by being part of botnet)