It's not a monopoly, there are lots of CDNs. Volunteer run P2P networks are vastly more vulnerable to DDoS. CDNs basically are P2P networks of a kind, they're just run by one organization and use dedicated network links for nodes to talk to each other so you can't disrupt the internal network comms too badly by doing DoS.

And the core issue here is that the site owners want it, so a P2P network that couldn't offer bot protection wouldn't get adopted.