Now here's what I don't understand. Namely. Wouldn't the security groups on literally any webserver anyone would ever set up ever just throw out packets with non-standard protocol numbers (i.e. anything except TCP, UDP, and ICMP)? Shouldn't these be trivial to block with a firewall? I just don't get how these could be an effective DDOS considering how easy they are to filter by firewall/security group. What am I missing here?
Small amounts of unwanted traffic are easy to filter with a firewall as long as it's distinguisable from wanted traffic, which would be the case here with GRE.
The point you're missing is that the victim is receiving much more traffic than it can handle. So much more that all uplinks are saturated, so valid traffic isn't coming through to the destination anymore. Filtering at the end point is useless then, so you need other, complexer strategies like scrubbing or upstream filtering to deal with these kinds of attacks.