> pop out a more specific BGP prefix from a backup path or secondary router so you can pull production away from the burning IP.

This won't help against carpet bombing.

The only workable solution for enterprises is a combination of on-prem and cloud mitigation. Cloud to get all the big swaths of mitigation and to keep your pipe flowing, and on-prem to mitigate specific attack vectors like state exhaustion.

I never claimed to be an enterprise, nor did I suggest this was the best option for them. Cheers!