Disclaimer: I haven't worked with IP transit in five years so this could very well be dated.
A single peer and a single IPv4 /24 (to me, at least) kind of tells the story of "Hey this might come in handy, costs a couple hundred dollars, and is just a couple of applications to fill out. Might as well." as opposed to something that's actually running in production.
While there is more autonomy with your own ASN and the resulting infrastructure there's also the obvious and required information leakage that comes as a result. Compared to being able to hide everything behind billions of essentially ephemeral addresses inside of a Cloudflare, AWS, etc at best (worst?) they've got a maximum of 256 easily discovered static IP addresses that Anonymous or any other DDoSer can readily point their bots at to obliterate.
I'm not familiar with DDoS mitigation equipment or products that HE has in place but I doubt they'd be able to as smoothly or economically absorb some of the large targeted attacks we've seen pointed at Google, AWS, Cloudflare, etc.
If Gab does decide to start multi-homing they would then need to coordinate DDoS mitigation across multiple providers and/or utilize some of the products from companies that specialize in layer 3+ DDoS scrubbing and clean return. This is all because anyone can just go grab all of their current IPs from the latest route announcement and bury them in anything from layer 3 to 7.
It gets very complicated and very expensive very quickly compared to how fast, cheap, and easy hiding your HTTPS stuff behind a CDN is. That's why everyone just does that.
If they're using their own ASN which transit providers they have and which datacenters they're in doesn't matter - all of their routes would be publicly announced and any reasonably competent attacker would configure their tool to pull the most recent route announcements from any number of looking glasses and update the bots. The internet will do what it does and happily route the legitimate and illegitimate traffic to any number of providers and datacenters worldwide.
At their (apparent) size and scale using their own IPs and their own ASN (both under their own corporate name) completely defeats the purpose of using a CDN, load balancer, DDoS mitigation service, etc and just doesn't make any sense.
To your point: on the modern Internet if you're banned from Cloudflare, Amazon, Google, and Azure (maybe a few others) even IF you can get hosted somehow/somewhere your next concern is going to be a DDoS. From what I know anyone large enough to handle a modern day DDoS probably won't do business with you either -or- will happily forward you a massive (six figures, easily) per-incident invoice and then probably give you the boot anyway.
I don't have any personal experience hosting controversial web properties but there are some HUGE technical, social, and political differences between The Pirate Bay and Gab, Parler, etc that the article fails to address.
EDIT: Above I describe receiving a per-attack invoice with DDoS mitigation companies. That's not actually how it works. I could get into it further but those costs are a rough ballpark.