What’s to stop the people ddosing them to turn their sights on smaller instances?

I don’t think they are doing it out of some deep-seated hate for Lenny.

I imagine they are script kiddies looking for attention and bringing down your instance with one or two users probably isn’t on their radar or worth their time. I seriously doubt little “single-user” or even slightly larger instances will ever be targeted