“For everyday users, however, who tend to submit only a few requests at a time, the added computational effort of solving the puzzle is manageable for most devices, with initial times per solve ranging from 5 milliseconds for faster computers and up to 30 milliseconds for slower hardware.”
Onion services hide IP addresses, so IP-based rate limiting never worked against floods. Tor 0.4.8 makes clients solve a puzzle that scales up under attack, to roughly a minute of work. A real user pays 5 to 30 milliseconds. An attacker pays for every connection, which is the only price signal that has ever stopped a DoS.