From their response headers, it seems like the request is coming from NGINX directly. How do they defend themselves against DOS attacks?

Big server. And if it goes down it goes down? Who cares, it's hackernews.