With a denial-of-service (DoS) attack, you're trying to stop legitimate users from using a service. A website that cannot answer its visitors cannot do its job, however carefully it checks passwords or protects their data. Keeping the service available is a security problem of its own.
The machine behind that service has a limited amount of time, memory, and I/O capacity to spend on its clients. Sometimes exhausting those resources takes a flood of traffic. Sometimes the server helpfully does most of the work for you! A small request can be expensive to handle, and waiting on a client can still tie up resources that others need. If you can keep enough of that capacity occupied, the server can stay alive and keep working while everyone else gets nowhere.
