Cloudflare is incredibly good at containing DDoS. The initial assumption of most people in the engineering security space was indeed that it was most likely a misconfiguration that led to X being vulnerable. He probably also fired folks who were responsible for business continuity and disaster...