That they've put it behind Cloudflare doesn't mean it's "served by Cloudflare"
Maybe Cloudflare gives them a good rate, or is donating service, but it's also possible or even likely that IANA is just using Cloudflare as a vendor, and therefore is paying for all the traffic, which is why they don't want people relying on it or hammering it all the time
In the nomenclature of RFC 2119, one MUST NOT design computer systems that rely on the correct operation of an HTTP server at [example.com.] Plus, it's *_really_* rude to pound on a small-scale service being provided as a courtesy.
Would you settle for any old static page served by Cloudflare? For instance, example.com? https://bgp.tools/dns/example.com