AFAIK, the 970 updates/s is a consensus limit given the current distribution of node machines in subnetworks. I don’t think DDoS protection was the reason it got introduced.
The boundary nodes have some rate limits as well to protect against DDoS attacks. Those consider IP addresses and connections as well for rate limiting, which the IC does not.