> However the internet doesn't require people to "operate at scale".
The internet itself does not, yes, but the internet as a system, filled to the brim with bad actors ranging from 14 year old skiddies with Metasploit over hardened Russian ransomware groups to virtually all nations' secret services and militaries does.
As soon as you start a server with a globally routed IP address, it will get hammered from all kinds of scanners. Anything on port 80/443 will get bombarded with Wordpress, Drupal and log4j attempts, anything on port 22 will get hounded by people attempting credential stuffing, and anything on port 25/587 by spammers and anyone trying to exploit Exchange/Exim vulnerabilities. It's a nightmare to keep up with that crap alone, and you're one forgotten update away from getting your server 0wned by someone using Shodan and whatnot.
And then, once your site, whatever you operate - I've seen as an admin DDoS extortion attacks happen against small sites for dog walker services, pizza parlors or random bloggers as well as large car dealerships - finds itself some opponent for whatever reason, it gets nasty. Be it for political reasons (people don't like what the blogger writes), for the lulz (people don't like a Twitch streamer so they DDoS their sponsors), or for financial extortion, doesn't matter in a time where you can order such attacks for less than the price of your average McDonalds visit. There is no, utterly no, alternative to the giants (Cloudflare, AWS CloudFront, Akamai).
It's sad that it has come to that point, but unless we get the most obnoxious sources of such attacks - enemy nation states (China, Russia) and compromised domestic IoT devices/servers - off of the Internet, there is really no viable alternative.