You're not wrong, and that is how a lot of DDoS mitigation works. It's a several step process.
1. Darknet of Mitigation Company reports that there is a lot of DDoS like activity starting to flood a specific IP range.
2. Said IP range is used by Company B who has hired the Mitigation Company to help protect them.
3. Mitigation Company analyzes what their darknet honeypots and scanners are seeing, identifies the type and scale of attack.
4. Mitigation Company alerts Company B, and tells them to switch their routing tables for their services to funnel everything through Mitigation Company's servers.
5. Now Mitigation Company is filtering all the DDoS junk flooding in, using their expert knowledge. They are also in contact with all the major ISPs and trunks along the route the DDoS is coming from, but a lot of this comes from other nations. There's only so much you can do in the telecoms industry when dealing with national divides, and how responsible other countries might feel about what's coming out of their ISPs. While the target of a botnet exists in one place, the botnet itself can exist in multiple countries, all around the world, all attacking at the same time, from all those locations. We're talking millions of PCs all simultaneously doing a thing. It's like if your entire yard suddenly exploded with ant nests, and you have one spraycan. You can call for help, others that will come and spray, but that will take some time. Or you can hire a full platoon to stand in your yard all day, just in case. And if ants never come, wow you're spending a lot of money to have people stand in your yard.
6. Mitigation Company is using its knowledge of the style of DDoS to mitigate the attack somewhat, but there are always false positives, and so users of Company B are still seeing timeouts, disconnections, or other issues.
7. Mitigation Company is also reporting back anything they learn about the DDoS to anti-malware companies, so that the anti-malware people can create innoculations or removals for the style of malware that might be causing this particular DDoS.
8. DDoS starts to dial down, Company B can resume normal operations, and Mitigation Company gets paid for services rendered if they're not already on retainer.
Wash rinse repeat each time the malware changes, the style of attack changes, etc. It's an arms race. The problem being, while anti-malware and mitigation does get more complex and sophisticated, botnets grow exponentially and have brute force on their side. If a botnet can't take down the datacenter of Company B, it might try to take down the ISP that provides them access, or the ISPs that connect to the ISP that provides them access, and so on.