I thought that was strange to but here's what they say on their website that makes it sound like you wont be charged for DDoS or bots
How We Count unique IPs (UIP)
The total number of unique IPs is tallied based on total number of legitimate individual IP addresses at the end of the calendar month. If a reader visits your website every day from the same IP address, that will equal 1 unique visitor for that calendar month, no matter how often they visit your website.
Unique is fair
Other providers might charge you based on website hits, website visits, megabytes of bandwidth, services offered and many other metrics. Some providers charge premiums during attacks. We opt for fair, consistent and predictable low-cost pricing that serves our clients fairly. Malicious bots or traffic generated during an attack are not something that you will pay for either, as these IPs will not be counted in your monthly pricing.