In general, yes - especially if those sites are not immediately revenue generating. The kind of infrastructure you need to defend against humungous DDOS attack

In general, yes - especially if those sites are not immediately revenue generating. The kind of infrastructure you need to defend against humungous DDOS attacks does not come cheaply, whether bought or outsourced.