Good piece - however, note that large ntp reflection/amplification DDoS attacks have been seen in the wild for the last several years, so this isn't a theoretical issue.

Game servers are also used for reflection/amplification DDoS - there are lots of old Quake3 servers out there, believe it or not, and these are also leveraged by the miscreants.

Most of the SNMP, ntp, & chargen reflection/amplification attacks, as well as a good proportion of DNS reflection/amplification attacks, leverage misconfigured CPE devices on wireless broadband networks which expose these services to the public Internet - in the case of SNMP, with default community strings which allow for queries of OIDs which will return large answers, and ntp services which will also return large answers.

A set of recommendations for broadband wireless operators intended to ameliorate the risk of such attacks can be found here: