Yeah we had a similar thing – our database backup machine was taken offline. It only allowed SSH traffic, and DO claimed it received a web (80/443) DDoS. We said the machine didn't have those ports open, and they said "just put Cloudflare in front of it". Completely missing the point, no actual understanding of what was happening.
So, I'd never put a production machine for a business with an active user base there, but... new machines on day 1 of a startup? Sure, it's dead simple. We also had good success with it providing on-demand VMs for developer use, AWS/GCP was somewhat locked down, cost managed, etc, but the team all had a login for DO and could spin up VMs for one-off jobs, that worked well.
So, I'd never put a production machine for a business with an active user base there, but... new machines on day 1 of a startup? Sure, it's dead simple. We also had good success with it providing on-demand VMs for developer use, AWS/GCP was somewhat locked down, cost managed, etc, but the team all had a login for DO and could spin up VMs for one-off jobs, that worked well.