OVH already put up a mandatory DDOS protection in 2013, with about the same price (article about the feature states 0.5 to 10€ per server : https://www.nextinpact.com/news/81703-ovh-protection-ddos-ca...).

Before that, sites that were the target of a DDOS often were simply disabled and their subscriptions cancelled.

At the time the practice raised a lot of criticism, since that was presented as an "option" that you could not refuse to pay for, which seemed a bit forceful. Now they're being more honest, the need to protect from DDOS has a cost, especially considering that a DDOS makes a lot of collateral damage and it is needed to protect innocent bystanders. Everyone pays a little bit, and those who actually need protection don't have to pay anything more. Maybe they've taken some inspiration from the French socialized health system :)