Your analogy is accurate, but... If you don't have a mitigator, they have incentive to force you on one; if you are already on it, their incentive is throttling

Your analogy is accurate, but... If you don't have a mitigator, they have incentive to force you on one; if you are already on it, their incentive is throttling, or otherwise 'attacking' (loosely defined) your source. With car insurance, the insurance company has incentive to mitigate their risk, (they don't want to shell out more than they need to,) charging more if you are higher risk. They don't want to take more risk than they have to. Key point, they evaluate risk on a case by case basis. DDoS mitigators however, they already have invested in the risk by getting the hardware to handle the bandwidth. They don't care if you are attacked or not. Nothing then stops them from playing dirty. This kind of stuff frequently happened with Minecraft servers (what feels like) ages ago. Mitigating services would go out and attack servers, and competitors to get customers to switch to them.