A hosting provider without strong DDOS-protection does not make your site work, and they will quickly kick you out when their infrastructure suffers because of attacks against your site.
CF & co can protect against DDOS primarily because they fight tooth and nail and weather the storm when a customer is attacked. Attackers know that they won't succeed, that's why they don't even try, and that's why CF doesn't have to deal with constant attacks against their clients. Your average hosting company will quickly fold against a large attack, and will then have to make a decision: suffer the attack, or kick you from their servers. It's obvious that they will kick you out.
Keeping a website available against opponents with some money to spend gives you a handful of companies that you can rely on.
