At their size, don’t they have some kind of hardware-level packet filtering ability like cloudflare to protect against these attacks?
The NaWas infrastructure is designed as an on-demand service. After detecting an attack, the traffic is routed via BGP to the NaWas hardware and then the mitigation process starts. All traffic is then rerouted and the own connections can thus manage with less capacity and thus remain cheaper.
To connect to the NaWas, a port must be available from one of the following parties: AMS-IX, NL-IX, LINX, NET-IX, Top-IX, M-IX, V-IX or one of these cloud interconnects DCSPine, Epsilon, Megaport.
Likely the attack isn't an overwhelming volumetric attack as I assume they have some fat pipes and big routers, but there's likely a bottleneck somewhere in their network.