Proof of work I get, but isn’t that like step2?

If I’m hosting at some IP, I still need Anubis or something to serve up the challenge, so doesn’t that become the attack point?