The difference between SurgeProtector and DelayAction is that delay action delays all actions of some type, whereas a SurgeProtector only acts if there are too many actions of some type. Suppose that I want to buy a thousand ice creams:
Under DelayAction, I order a thousand ice creams. In a week's time, they arive on my door step in one big box.
Under SurgeProtector, I order an ice cream, and I get it immediately. Then I try to order another, but I'm told to wait. So I wait a day, and order another, and get it immediately. Then I wait another day, and repeat. After a thousand days, I have got a thousand ice creams.
Of course, the two are not mutually exclusive.
To some extent a SurgeProtector is a more SoftSecurity solution, as it seeks to LimitDamage to manageable levels. DelayAction is "harder" as it seeks to eliminate damage by means of PeerReview and "time as an insurmountable fence". The downside for being "harder" here is that you lose some agility (see discussion at FileReplacement).