Attackers will switch to attacking an IP that isn't null routed. You could theoretically keep changing your DNS entries. But many ISPs cache entries for a day

Attackers will switch to attacking an IP that isn't null routed. You could theoretically keep changing your DNS entries. But many ISPs cache entries for a day instead of whatever your TTL is, so you get customers locked out. Source verification is called BCP38, and as for the cost, this standard was published 13 years ago, and the majority of networks haven't implemented it.