ddos as a service providers (aka booters/stressers) proxy L7 request floods via VPN providers. At some point the VPN providers might actually care to kill off those accounts / better tighten up their free tiers, but they don't care at the moment.