Well, there will probably be ways to tell apart BU nodes from Core nodes for a while.
At least, a BU node that wants to pass off as a Core node must get some switches to identify as a Core node, and it must also offer the same interfaces (CompactBlocks) and refuse the BU-only ones in the same way that a Core node would.
That's a lot of effort for questionable benefit. Any attacker already has known BU nodes mapped out by their IP addresses, and can DDoS your node no matter what face it presents.
A much better way to minimize any DDoS impact is to get more BU nodes up and running.
Those crash bugs are starting to piss me off already. You can't have more nodes online if the existing ones are so vulnerable. No one wants to install BU any more anyway. If there was such a disguise in the first place then the attacks wouldn't affect business critical production nodes. I think you are wrong and I think BU is becoming a sinking boat. It sucks because now I no longer have any alternative to the Core.