> Something like 1% of HTTP hits pose some risk of spam or fraud
It doesn't matter if it's a tiny percentage of requests that are spam/fraud. The only thing that matters is the absolute amount, and that's massive.
> Static file serving is very difficult to DDoS
No it's not, and most pages aren't particularly static. They're hitting all sorts of databases and caches and stores.
> generally the DoS actor has to pay more than the victim website
No, generally the DDoS actor pays very little, because they're using bots infecting other people's devices. The bandwidth is free because it's stolen.
> be weighing "a thousand signals" to decide which version of the truth
Nobody said anything about "truth". You're either blocked or you're not. Page content isn't changing.
Yes, spam and fraud and abuse prevention does require weighing a thousand signals. It always has. It sucks, but the world is an adversarial place, and the internet wasn't designed with that in mind.