I think you identified the root of the problem: our DNS servers are quite hardened but there are some attack vectors that we just can’t stop if the attacker has control of the machine/VM.
That being said, we currently lack the funding to rent all of our own infrastructure. geodns is fairly lightweight but I estimate that it would still represent around $5K-$10K per year in hosting, just for the DNS.
If anyone has established contacts at AWS, Azure or Google Cloud, having a sponsorship from them would certainly allow us to improve our security posture greatly. Right now, one VPS provider is sponsoring us with 4 VPS (we’re really grateful for that) and Ask personally funds several more, but we still rely heavily on volunteer-run servers to maintain the DNS servers.