Isn't the issue more with how we implemented IP than BGP? AFAIK, DDoS attacks would be far less effective if every ISP implemented BCP 38.