There is no requirement in a substantial botnet for this, even a small one will do. Also internet is full of cheap amplified ddos offerings. Attacker could use

There is no requirement in a substantial botnet for this, even a small one will do. Also internet is full of cheap amplified ddos offerings. Attacker could use multiple offerings for more bandwidth if he feels like it. Maybe this is something obvious you are missing.