> If the system is configured to "fail open", and it's something validating access (say anti-fraud),

The problem here isn't the DoS, it's the fail open design.

If the majority of your customers are good, failing closed will cost more than the fraud during the anti-fraud system's downtime.