This is abstracted away from the customer and there is a wider and richer grayscale than at least I imagined before working at a data company and looking at IP providers for outbound. You have your TV sticks and VPN providers where a careful squinting at the ToS will tell you that users on the other end are signing off on the right to have their bandwidth leased. I don't see how else the supposedly legitimate providers of residential IPs could possibly offer the supply, geo-diversity, and pricing they do.

free hosting

For botnets, yes.

For L7 request floods - they spin up a few dozen machines and use open & private proxies to funnel http requests thru. Sometimes those proxies are misconfigured squid, sometimes it's private proxy services, sometimes it's compromised machines converted into proxies (which may be open or require auth / has been sold).

For L3/L4 amplification/reflection they're buying machines where they can spoof and using UDP amplification lists (other people's machines) to reflect off of (and obviously not getting permission to, etc.).