Correct. Which is actually how this attack is happening. It's using Baidu's servers, which are ostensibly very robust. If you were to hijack Google/Amazon/Facebook/Netflix servers, you'd probably be able to DDOS nearly anyone on the planet.

And yes, there are ways to essentially start throwing servers online and yes companies do it. The problem is it becomes obscenely expensive — if you do this and go bankrupt, again, the DDOS has succeeded. It's actually somewhat problematic to do it automatically for exactly that reason. What if you preferred to just take your service offline until you could investigate enough to stop the attack instead of pay hundreds of thousands per day in server costs?

This is why DDOSs are a bitch!

Edit: Also worth noting, it's probably for this reason that Github is still accessible: throwing servers online and eating the cost.