If it were specifically done to make a political point, having the attack come from Ukraine could be symbolically important. I would expect a harassment DDOS to

If it were specifically done to make a political point, having the attack come from Ukraine could be symbolically important. I would expect a harassment DDOS to try to cover their tracks, but someone protesting Musk might purposely not obfuscate their location or purposely attack from Ukraine. Of course, Russians might just want to make Musk even more anti-Ukraine.