Hosting for millions of visitors/hour isn't that hard. Maybe the cloud companies want to make you think otherwise, but a handful of bare metal servers around the world should be enough to handle that kind of load unless you're streaming video or running a really heavy web framework. Those can easily be obtained for free if you're already a criminal and have access to compromised servers or stolen credit cards to buy them with.
The point isn't tech scalability - the point is that scaling to that many visitors requires payment, and many cloud providers have anti-fraud mechanisms in place to prevent scammers from doing this quickly and easily without being traceable.
