“Imagine a distributed denial-of-service attack where the incoming IP addresses are all from Google and Amazon. That becomes a challenge. You can’t blacklist that whole IP range.”

Why exactly not? Amazon and probably Google cloud's IPs are probably available publicly, and you can probably discern Googlebot's IP from the cloud ones (using user agent, or even ip ranges). You can sensibly block IP ranges from any dedicated hosts/cloud providers. Only <1% of them would be valid traffic (ie someone working in AWS going to your site directly)