I would also attribute it to incompetence. It's quite simple, actually.

If it was DDoS and the problem was with the network, the API would return ZERO as the API lag value, as the API should be unaware of any network issues.

As soon as their API returns a lag value, it's the trading engine itself that can't handle it, irrespective of the network connectivity.

That's the reason why even the best DDoS protection company in the world won't change a thing.