I want to be fair here. I run Windows Server on several budget VPS instances, in my experience the "DDoS protected" badge means very little below $20/month.
The economics are straightforward. A 100 Gbps attack costs the attacker maybe nothing if they have a botnet. Mitigation at that scale requires scrubbing centers, transit agreements, engineering staff. Your $4/month plan does not cover 20 minutes of an engineer's time. To be fair, some providers are transparent about this. Most are not.
I asked a host last month what their protection actually does. They said "automatic mitigation." I asked for specifics. The ticket was escalated three times. Final answer: "we filter bad traffic." That is not an answer.
If you are paying under $10 and believe you are protected, I suggest testing that belief carefully. In my experience, the