One of the reasons why it became like this is because there is no protocol that would allow a host to request blocking traffic from other host on upstream provi

One of the reasons why it became like this is because there is no protocol that would allow a host to request blocking traffic from other host on upstream provider (so that malicious traffic is blocked close to originating network). If there was such protocol, site owners could protect from attacks themselves, but without it you have to use Cloudflare unless you are Google scale with channels wider than attacker's.