Honestly, I think the platform is pretty stable if you take out the outages caused by DDoS. Let's also be honest, would anyone be shocked if those DDoS's were actually sourced by a competitor who lost users to this platform?

It takes a ton of time and effort to be able to build robust DDoS mitigation strategies, even for Fortune 500/100 companies. Sure, you can throw yourself behind a known mitigation company, but their out of the box rules don't always work for you. Most of the time you go behind them in a "transparent" mode and begin slowly deciding what is and isn't a real threat. Volumetric attacks are easy to deal with - "hey, that's fake traffic, block it.". Attacks like the admins of lemmy.world have talked about are application layer and require much finer tuned filters. You can't just immediately say "block this" because you may block legitimate traffic.

I think it's more about getting the time to be able to develop the features mods want after dealing with how to protect the site, than it is about "stability of Lemmy"