> This way, a malicious actor can buy thousands of GDPR requests and DDoS anyone but big companies like Google.
FWIW, request letters like this have been possible in Germany for multiple decades, and I haven't heard of any DDoSing of companies yet. Here's a representative e-mail template whose lineage goes back to 1998: