Mostly economies of scale. They have enough data to do the statistics to identify bad actors, and enough bandwidth and servers to facetank the request volume.