Yes true. But that costs money and makes attacks slower specially if you are doing malicious activities. Also is not difficult to ge VPN IPs and block them all. You probably can buy those lists or get services that block them.