How are DoS attacks prevented? Say the network is flooded with these output creating tx.
A transaction which has 10 inputs and 1 outputs counts as -9 UTXOs. There is not a DOS attack. In fact, it it is the opposite, it reduces database size for everyone. Once the transaction is accepted, 10 entries can be deleted from the database, and one entry is inserted.
The suggestion on the mailing list was that removing UTXOs wouldn't quite balance out inserting new ones. UTXO_change = (input_count - 0.75 * output_count) * UTXO_size_equivalent. This still encourages removing UTXOs.
UTXO_size_equivalent was 4 bytes. This means that removing UTXOs made the transaction appear to be slightly smaller.
If I'm not mistaken you'r not a UTXO until after some time you remain unspent.
No UTXOs are added immediately to the database. Coinbase transactions are not spendable for 100 blocks, but they are still added to the database.