I don't see why Cloudflare would require JS to be on
Maybe they can do it better and not turn people without JS away (at least while accesses are at a regular level)
For that to work they need to fingerprint and track you. Which is why they said they block users with NoScript or on TOR.