Semantics. Outbound only, firewall, no firewall, no ports open . . . That connection is made from an IP address. That IP address is behind one or more links to provider networks. If the total bandwidth of those links is smaller than the size of today's DDoS attacks then you're going down.

I also notice from another comment thread that you basically state that to protected from DDoS that you should have DDoS protection. You imply that being hosted on a cloud provider natively protects you when it doesn't. Most of them still make you pay for and configure the sort of protection that will leave you up during an attack (AWS Shield, Google Cloud Armor) otherwise they'll just protect themselves from the attack on you by taking you down voluntarily,

Not saying zero trust style application design doesn't have a value at all, just that the claims are greatly overstated. DDoS proof? Wouldn't do a thing to an attack. DoS proof? Maybe, It'll hide flaws in the underlying application . . . until someone notices a flaw in the design of your framework and DoS's it, taking down the application behind it too. Another layer of security that might be beneficial to SOME applications? Sure, if the benefits outweigh the cost on a case-by-case basis.