Aha, you forget the part about the million assholes at your front door all trying to ring the doorbell.
Your legitimate friends might actually be in that million, and they're trying to get to the door... but they can't, because there's a million assholes trying to ring the damn doorbell.
By some miracle, one of your friends actually makes it to the doorbell, THEN you let them in. This is why during a DDOS attack, you might get amazingly lucky and actually be able to log in. By pure dumb luck, you managed to initiate a handshake and the server went "oh thank fucking god, someone who isnt an asshole" and lets you in.
But then you do the stupid thing, and realize that you forgot something in your car, so you have to go back outside. And goddamit, the only way back in is through those million assholes. This is also why if you're already logged in, you're could be perfectly fine, but as soon as you do the stupid thing and log out, you're screwed.