DDoS-protection is only part of it. You also need the ability to distinguish automated browsers from real ones, or you're going to have several full time jobs' worth of cleaning up spam comments from everything that even slightly resembles an input field.
This is bullshit, there are a plenty of alternatives.