I can outsource things like ddos protection to my cdn provider, but that would still be just kinda hoping I didn’t have any attackable surface I didn’t think of prelaunch.

In that case, I wonder if your money would be better spent on contracting a security review. If you’re worried about unknown attack surface, I’m not sure that funding organized crime to rent a botnet would help. Botnet operators rely on you to tell them what to attack, so you’re unlikely to discover anything new here. Better to hire a professional and get a fresh opinion.