Yes and no
If I'm paying someone to secure my network, and one day the traffic patterns change substantially and he wasn't expecting it, I'd want him to block that source until he understood the change. And I'd want that person to be more paranoid and dogmatic than I am.
In that couple hours before he opened things back up, was he researching the new aggregator to confirm what you told him? Or did he just give in to the screaming?
In that couple hours before he opened things back up, was he researching the new aggregator to confirm what you told him? Or did he just give in to the screaming?