Cloudflare has a really clear and seemingly mandatory option which is to just assert what we all know to be true: They can boot clients whenever they threaten their business. Everybody does this. There are near constant stories of users getting business-critical Google or Apple accounts suspended without warning or explanation. Those companies are ruthless about protecting themselves from liability and will err on the side of losing customers even when the violations aren't proven. Cloudflare wants to be seen as being above the fray and they just absolutely aren't. Anyone who thinks "it's just politics" is delusional. These are real people doing real things with real consequences.