Currently, DDoS doesn't require compromised hardware, because of spoofing.

But if there were no spoofing, compromised hardware would be a requirement, and we're one step closer.