Lots of ISPs have AUPs that would prohibit a site like KiwiFarms and the sky hasn't fallen. Why can't Cloudflare do the same?
It comes down to content moderation. If a company begins to moderate content that travels through its network, it can be held liable and forced to remove things that any entity or governmental body could disagree with. For example that means if the Republican Party was hosting on Cloudflare and the Democrat Party disagreed with the Republican Party, they could force Cloudflare to remove the Republican Party's website…
Cloudflare already does this, especially to services involving sex workers.