There are 21 BP nodes, how do they prevent DDOS attacks that knock them offline by sending massive amounts of traffic to these public ips?
We hope they are paid well, perhaps when the EOS toke price picks up like 10x, to maintain high-end DDOS mitigation infrastructure.
Assuming geographic redundancy and cloud-level diversity, it is possible to have a very strong resistance towards massive DDOS attacks. However, if most of our BPs are concentrated on AWS or Google Cloud or God forbid the Microsoft one (sorry could not resist), then your concerns are extremely valid.
Having geographic data-center redundancy, ASN number ownership, and a bunch of hackers on the staff would be a good starting point for many of the BPs.