The attacker would need way more power actually, to send enough requests to flood the server. You only want to get one request in.

If the server can process 10k requests per minute, and you need to send 10 requests per minute, you only need 0.1% as much power.