> DDOS doesn't destroy websites. It just makes them unreachable until the disgruntled person decides it's been running long enough.

You can be absolutely destroyed if your hosting provider later hits you as a Website Owner with an excess traffic bill.

Fire your provider then. They're probably not paying for inbound traffic (most orgs are billed on the dominant traffic direction, so inbound for eyeballs and outbound for hosting), so it's pure extortion on their part.

While it is entirely possible to enter such a contract with a provider, it is your fault in the end. Don't maybe enter them?