If they offer a platform as a service and they fail to protect that platform from ddos attacks, they should incur the cost and not the customer