Our documentation states that some route annotations provide "basic protection against distributed denial-of-service (DDoS) attacks".

That statement is false. Those annotations provide basic protection against DOS (denial of service) but not DDoS (DISTRIBUTED denial of service). And the reason is very simple: Those annotations impose limits to concurrent connections, connection rate or request rate TO THE SAME SOURCE IP, so if the DOS (denial of service) is distributed (DDoS), limiting individual IPs does nothing, because each individual source can be under the limits imposed by these annotations yet there is an attack due to the big number of clients.

These annotations only protect against individual clients trying to abuse alone, not an abuse consisting of having too many clients (which is the definition of DDoS).

All the OCP versions

Always

1. Read the docs
2.
3.

Wrong docs

Good docs

It is quite urgent to clarify this, as the statements about DDoS may create false expectations in our user base.