The term bulletproof refers to a hosting provider's policy of not acting on complaints. When a competitor, rights holder, or government agency sends a takedown notice to a standard host, the host typically suspends the account within hours. Bulletproof providers do not forward or comply with these notices because they operate in jurisdictions where the notices have no legal effect.
This does not mean anything goes. Legitimate bulletproof hosts maintain their own acceptable use policies and refuse to host content that violates international law - such as child abuse material, malware distribution, or denial-of-service infrastructure. The protection is specifically against unfair or politically motivated complaints, not a blanket immunity from consequences.
The core technical difference is jurisdiction. A server in Iceland, Romania, or similar privacy-friendly countries is not subject to US DMCA orders, EU Article 17 takedowns, or the domestic laws of the complainant's country. The provider simply has no legal obligation to act, and reputable bulletproof hosts choose not to act voluntarily.