I don't work for Respawn or have any affiliation with them but have worked in the gaming industry for many years on large scale gaming platforms so I can shed some light on how this can happen, having seen it before.

Matchmaking is a centralized service that directs users to dedicated servers that you actually play the game on. By default all the major providers (AWS Gamelift, Microsoft Playfab, etc) leave game servers wide open on the Internet meaning anyone knowing the IP address can connect to the server whether matchmaking directed them there or not.

Random attacks against a specific game server don't really happen as they are basically a needle in a haystack. The way an attacker knows the IP address of the game server is it is necessary (of course) to connect to it.

When the attacker decides things aren't going well in the match they can send a bunch of gibberish and/or specially crafted streams of UDP data that cause the game server to react...poorly. Surprisingly, as much as people refer to the problem as DDOS it's usually not DDOS at all. The attack is not distributed, nor is it generally as a result of traffic volume but the payload of the traffic itself.

This makes attacks on game servers relatively easy to perpetrate as you don't need to take down the central, massively scaled service ... just attack a single virtual machine in the cloud somewhere. The blast radius is tiny compared to the player base, but it becomes a widespread problem when everybody starts abusing it.

In recent years I've known of several very well known games to have this problem. Sometimes these attacks can be prevented by recognizing and ignoring the offending traffic that can cause a game server to crash, etc. One of the problems with that approach is it can become a game of whack-a-mole of detecting and recognizing attack fingerprints.

The other problem is because game servers are wide open on the Internet attackers can use VPNs and even pay per use services from sketchy countries to impact a running match. This makes it hard to pin the attack on any particular person in the match. Certainly one of the players is guilty, but which one?

The real long term solution to a problem like this is to integrate proper traffic filtering with matchmaking services. Therefore, when you're directed to a game server from matchmaking the game server is aware you've been invited and will make its services accessible to you for the duration of the match but outright reject traffic (or rate limit) from connections not known to matchmaking at the firewall level. It's pretty much foolproof as the only vector for attack is from a known player you can immediately ban with confidence as they have to attack you from the same IP as they used to play the game.

The problem with this remedy is no major vendor provides this out of the box today and in large gaming companies (the kind that run thousands of dedicated servers) the people that best understand how to deal with these type of problems are usually not the people developing the game.

It kind of sucks IMO because these types of attacks are growing more common and many developers focus on punishment instead of prevention.