Surely the DDossers will just use some of their botnets for generating the POWs? I don't think I fully understand the scheme. Is the idea that as the attack progressed this would consume more and more of their resources making an attack impractical? Surely in that scenario more and more of the real traffic's resources would be consumed by them having to solve puzzles also, so Tor would in effect be cooperating with the attackers and DDosing all of the valid clients ?
No, I think it makes the the experience strictly better for normal ("real") users. On phones it might burn too much battery, but on desktops or plugged in laptops dedicated users can configure their user agent to send in difficult proof of work submissions, getting closer to the front of the line. The actual problem starts when each individual request coming from the botnet starts submitting more proof of work then the real users can tolerate (due to taking too long), and that's where it's pretty much the same as before the DDoS protection system existed.
Except now the botnets need a lot more computation and thus electrical power to generate the same amount of traffic as before, making DDoS attacks more expensive for the attacker, and less expensive for the service.
I think there is a second cost aspect to this as well; right now, hacking low-powered IoT devices and making them part of your botnet is (relatively) easy and valuable, but as their computing power is quite limited, a PoW defense should make them less viable for DDoS attacks, decreasing the amount of free attack power.
Botnets usually consist of networks of captured low spec IoT devices (mostly routers, sometimes exposed IP cams etc.). They might not have the hardware required to outbid real users in PoW.
