Everyone talks about this like it wouldn’t open a massive attack surface for the mother of DDOS.

Make the attestor slow or take it out, you take down large parts of their business. I don’t know, i wouldn’t put too much stake in a platform/website that could be taken out so completely.