Earlier quoted context omitted.
The chance that someone wants to connect to your ancient server from an ancient client that can't pass Cloudflare's DDOS protection is probably way higher than someone wanting to DDOS it. (For example, most people may not realize that Cloudflare DDOS basically makes the website inaccessible via TOR for many people.) Preemptive protection against attacks that never come makes the internet worse for everyone.
This old chestnut again, really? You can whitelist Tor without any issues on CloudFlare. It's one of the first things most people do. Read the documentation.
It's implied with CF that you block people they can't track and prove to be innocent. Hence this old chestnut still existing: it's no joke.