Except an attacker now has to have access to many orders of magnitude more compute, while the hidden service can instantly verify PoW. Asymmetry FTW.

Honest clients do PoW once.

Please explain how PoW doesn't work as a measure of DDoS prevention, although of course it won't prevent it entirely. At worst it drastically increases costs for the attacker, at best it makes it prohibitive enough they stop altogether.