In general, yes - especially if those sites are not immediately revenue generating.

The kind of infrastructure you need to defend against humungous DDOS attacks does not come cheaply, whether bought or outsourced.