DDos in theory is a legitimate threat to you when staking and if someone did perform one, which in theory is possible, you would lose the duel.
To do one someone has to have more internet upload bandwith than you do by a bit and they need to know your ip address.
In practice, not many people have more up bandwith on their home connection than you would have down, meaning they would have to pay for server access somewhere.
In practice, they have to have your IP address. They cannot get that from runescape.
So, if someone you don't know suddenly asks you to duel on pchat for rares when you are not in their world or at the duel arena I would be suspicious.
If someone just finds you at the duel arena they are not able to ddos you in practice.