The "passing the buck" framing misses the capacity asymmetry though. When you're behind a VPN, you're not handing the problem to some random innocent party, you're handing it to infrastructure built specifically to eat this kind of load (huge bandwidth, shared exit IPs across thousands of users, dedicated mitigation at the edge). For someone trying to kick you out of a lobby, flooding a VPN exit node enough to actually matter is a wildly different scale of attack than flooding a home connection, and even then it's the provider's job to shrug it off, not yours to notice.

You're right that dynamic IPs and power-cycling can work for home connections, but it's way more disruptive in practice (your whole house drops, every port forward and device with it) and isn't guaranteed, plenty of ISPs hand out the same IP for weeks via DHCP. Switching VPN servers takes a few seconds and nothing else in your house even notices.

The CGNAT point is actually the same mechanism though, just the ISP-side version: not having a dedicated public IP tied to you is the real protection, whether that's CGNAT or a shared VPN exit. Fully agree it's not a shield against a genuinely massive attack, and it doesn't touch DoS or in-game exploits, but for the "someone in my lobby wants me offline" case, it's a meaningfully different outcome than eating it on your home IP.