By having all TCP packets proxied by the entry node, the number of incoming IP addresses for the relay operator is significantly reduced. 

This simplifies IP blacklisting in case of an attack, as NWS funnels all client requests through the entry nodes. Consequently, the  distribution of requests is determined by the total number of entry nodes.

If your goal is to DDoS Nostr relays, it's likely more effective to flood them with normal events.