Yes, they do have to be open. Properly configured authoritative only name servers will allow full zone transfers (AXFR) only to their slaves. The amplification

Yes, they do have to be open. Properly configured authoritative only name servers will allow full zone transfers (AXFR) only to their slaves. The amplification part of the attack comes from the fact that they aks for zone transfers, and zone transfer replies are much larger than the requests. If they were just doing normal DNS lookups for records you wouldn't have an amplification factor.