My country is very small yet has 6.5 million people. Surely you can't be serious by saying that I'm to be responsible what each of them is doing on the internet?
If the country is the source of an outsized number of bad actors then – probabilistically and at scale – "you" are responsible, yes. I'm not trying to be blame-y here in that I mean the probabilistic "you" and not you personally.
Whether you personally deserve the consequences of that responsibility is more ideological than pragmatic - you probably do not deserve it, but how do others find out which you are? That brings up questions of system design, and avenues available for remediation.
If your small country creates outsized issues for the internet as a whole it might not just be defensive measures that are to blame for insufficiently punishing or defeating attackers. In that case, economics and politics might factor in and the question becomes different.
It's small enough that it probably couldn't even bring down a single CloudFlare-protected website IMO. And when we've seen stats here on HN about recent attacks on GitHub, the total bandwidth was what, 1.35Tbps (~169GB/s)? (Link: https://www.zdnet.com/article/github-was-hit-with-the-larges...)
I've met sysadmins here in my small country -- guys and girls who administer several thousand gigabit-fiber-to-the-home 1Gbps connections -- who said that for a ~$15,000 tech investment they can build small infrastructure that can withstand 10Tbps DDoS attack, if their upstream ISPs don't cripple bandwidth under pressure.
Not saying they might not have overestimated themselves but it's a data point regardless.
I don't know for sure either way because I am not a professional sysadmin or a hardware guy. But I feel a lot of hosting providers are just chickening out. Perhaps it's the ingress/egress charges? But 169GB/s definitely doesn't sound that scary. My $140 router can handle sustained 110MB/s for hours. I can't imagine there are no clusters of enterprise-grade tech that cannot sustain 200GB/s constantly?