The unique problem induced by hard-fail certificate is that it introduces an additional choke-point outside the control of the site owner but in the critical path for site function, one which typically is not particularly well-resourced.
Since all secure sites require TLS certificates, and since most certificates are issued by one of only a small number of CAs, these CAs would represent a highly attractive target for people interested in causing disruption. And furthermore, these CAs are in almost all cases particularly ill-equipped to fend off an advanced denial-of-service attack, especially as compared to the sites they protect.
As long as most people leave hard-fail CRL/OCSP verification disabled, the CAs will not be targeted because the damage of such an attack would be minimal. But if strict verification ever becomes the default in a browser, then an attack against Verisign or RapidSSL or Comodo could take out entire swaths of secure hosts, doing vast amounts of damage.
Denial-of-service attacks are often used to mask or enable a more advanced and targeted attack. But in the case examined here, the true target of such an attack may never be known. The collateral damage would be so vast that tracking down a single victim would be impossible. It would be like shutting down the power to an entire city in order to rob a single jewelry store. But if the power company is an easier target than the jewelry store, then such an attack would be plausible.
As another analogy, if verification was the default, then taking down DigiCert's or Verisign's online verification service would be a lot like taking down the entire
.com DNS registry. Many companies depend on it, and protecting it is outside their realm of influence.
Right now, for example, DigiCert is the CA used by Facebook. And while Facebook has multiple datacenters scattered throughout the world, DigiCert does not. Facebook has the resources to withstand an attack larger than anything anyone has ever seen. But DigiCert does not. If hard-fail certificate verification were the default, then an attacker needn't attack Facebook to be successful, he would only need to take down DigiCert.