It sounds like these are DDoS-as-a-service providers who try to appear to be legitimate businesses and cover themselves with terms of service. It's basically a legitimate looking site but they do a psst, hey we do DDoS.

To do that it sounds like they may advertise themselves on the dark web as an attack web site. They also don't bother to verify ownership of a target, like checking domain ownership for example is probably the most common use case here. They also use other people's mis-configured devices to amplify their attack. That last part is particularly salient I think.

It's very stupid to advertise yourself on the dark web for this if you host a site on the clear web. But you are probably right that LE lets this goes on for longer than it needs to. I don't know how long they have known about these sites or how they go about finding them. It sounds like it's just based on victim's sending in reports.