That is right. I tried to be transparent what is it NOT: https://angieguardian.org/guide/threat-model#what-guardian-does-not-defend-against

There's loads of DDoS alternatives.

It's a national security threat to give your httpa private keys to a US company. As a result, loads of alternatives exist for real DDoS attacks.

But also, almost any nonprofit social media site can just get away with a self hosted pow solution.