Blocking bots should not be the default behavior, it should be opt-in. Is Cloudflare trying to play both sides in order to secure a fee on every pay-to-crawl in the future?
Cloudflare's business model is playing both sides. They sell anonymity to attackers and mitigation/protection to the victims.
Yes. Obviously.