Your first statement is true, but the traffic doesn't have to be successfully terminated for an attack -- a DDoS attack can easily fill your internet pipe with traffic even if your firewall silently ignores it (and indeed, once the attack is underway, it's likely that your servers can't keep up with the request rate, so many of the connections are going unanswered). So a VPN is no magic bullet.