Cloudflare showed themselves to be profit-driven and irresponsible years ago when they said they could not and would not take down blatantly illegal sites they host / facilitate (I don't buy in to their bullshit attempts to redefine "host") [1].
I get that you shouldn't be able to contact them, or any other entity, and just make a claim to get a site taken down (look at abuses of the DMCA), but when the illegality is unquestionable, it's just a sign that Cloudflare clearly doesn't want to set any kind of precedent about doing the right thing.
What's unquestionably illegal, you ask, because you're about to tell me how much of a grey area that is? Bank of America phishing sites are unambiguously illegal. Any reasonable human would say that anyone pretending to be Bank of America to try to steal credentials has no place doing so, and that there's no reason to not take direct action.
Sites hosting Adobe Flash "updaters" are also unambiguously illegal.
The fact that Cloudflare says they can't take down sites like these because they're protecting "First Amendment rights" shows that they don't want to be bothered with abuse complaints and they care more about profit than anything else [2].
It's disingenuous at best and purely evil at worst. It's saying, "I have the tiniest thread of a reason to continue facilitating illegal behavior because who really knows who BoA are?"
They said the same about Adobe Flash "updater" sites that provide Trojan / virus downloads.
If that's not bad enough, they refused for many, many months to answer a question directly, without diversions. I asked them:
"When I send abuse complaints to abuse@cloudflare.com, I get a form response that implies, but does not clearly state that action will NOT be taken unless I also visit Cloudflare's web site and fill out an abuse form there. Is it true that no action will take place unless I also fill out that form?"
They refused to answer directly, instead constantly telling me that filling out the form helps them improve abuse handling, et cetera. They would not answer yes or no, even when asked directly to answer yes or no. Who does that except assholes?
The form, by the way, has all sorts of issues which makes using it arduous and time consuming, which is, I suspect, exactly what they want.
When people have an opportunity to communicate unambiguously yet choose to double down on being vague, they show themselves to be assholes who want to manipulate others. They did, after many months, finally answer my question and acknowledge that they don't process abuse complaints if the web form is not filled out, but this was only after months of repeatedly asking.
I get that some people use their products and want to assume the best about Cloudflare because they like the products, but any shitty company with shitty, profit driven people running it can still have good products. I encourage those who think Cloudflare is good because their products are good to consider the end result should Cloudflare get their way.
Imagine this: a majority of the world hosts using Cloudflare's DDoS protection. They all have Cloudflare in their WHOIS. Much of the world also use DNS-over-https in their browsers. Cloudflare becomes a monopoly and gladly continues to ignore court orders and legal subpoenas. Network admins can no longer control their own networks - they can't block exposure to malicious sites using DNS or by blocking networks, can't stop CaC access, can't stop exfiltration of data because everything is going to and coming from Cloudflare, legitimate and malicious.
Not only have they re-centralized the Internet and have become a big, glaring, single point of failure, but they've weakened our networks and taken control of them away from us. They're privy to every DNS lookup we make and every web site we visit. As an entity based in the United States, all of this data is almost certainly available to the United States' surveillance apparatuses.
[1] "hosting" is providing material services without which certain things on the Internet wouldn't function. Consider the fact that Clouflare wants to redefine "hosting" to mean directly hosting a web site (not DNS, not email, not proxy services), but hosting existed before the web existed.
[2] It doesn't matter if scammers use Cloudflare's free services; the motivation for profit means they want everyone to use them, good and bad, so people can't easily block the bad without blocking the good. Protecting scammers sets precedents that discourage people from trying to blame Cloudflare for facilitating and hosting. Also, they want and intend to be a monopoly, so enticing people using free services is still profit-based, for those who can't think that far ahead.