There are two sides to creating a connection and traffic can be filtered on both ends.
On the initiator: any invalid outgoing packets can be filtered
On the receiver: any not expected / invalid packets can be filtered
Just a question: how can the hoster determine whether a packet is part of a port scan or valid connection request?
Unless the packet is mangled/invalid (ex: out of sequence like fin / syn scan) it can't as it is unaware what services are running at the other end. Effectively what the hoster is also doing, is imposing a rate limit on rate and number of connections.