A lot of these solutions don't actually mitigate large DDoS attacks, or have enormous loopholes that can be bypassed by a novice attacker. I've heard that OVH's DDoS protection used to let in other OVH servers, for example.
When I checked, some of the equivalents to Cloudflare's lower plans cost hundreds of dollars a month.
