There's a few different strategies employed when it comes to launching successful DDoS attacks. The goal of a DDoS attack is to target and exhaust a resource in order to disrupt a service, so it's essentially a battle of resources; resources to attack and resources to defend. A resource here is a very broad term, and different DDoS attacks will target different resources to different effects. Resources can range from hardware, to OS, or provider imposed limits. Some examples are Memory (RAM), CPU, Open File limits (active TCP connections), Network bandwidth and so on.
A company has a finite number of resources for defending against DDoS attacks and can therefore only defend against a finite amount of DDoS traffic. This comes in the form of how much budget they've allocated to protect their systems (DDoS mitigation appliances, IDS systems with a set number CPUs and RAM, or cloud scrubbing subscription levels). The imbalance comes where attacking resources are usually exponentially cheaper than the resources used to defend, typically because they're illegally obtained (malware spreading and infecting systems).
Because of this imbalance between the costs of attacking and defending, it becomes much easier to generate attack traffic beyond what the limitations of the resources defending against it can handle, even if they can do so fairly efficiently. This is why attackers are generally still successful. They generate enough attack traffic so that they'll hit a bottleneck of one or multiple of the defending resources. In most cases, for volumetric traffic, it will network bandwidth limits. If you have a network bandwidth, then CPU will likely be the bottleneck from processing millions of packets.
Another strategy attackers use is to specifically use resource intensive requests that look like normal traffic. The most common case of this is using HTTP requests. If you're running a web server then you're expecting HTTP traffic so you'll to do a deeper inspection of the traffic (known has Deep Packet Inspection or DPI) in order to determine whether it's legitimate or not. This is more expensive on the defensive side and therefore less resource intensive for the attacker. This makes it even more difficult to detect because these are not "loud" and doesn't necessarily look unusual to the receiver.