However, all of their advertising material kept reiterating that they were making money off low-tier customers by collecting lots of data required to properly serve their business and enterprise customers.
This makes it sound like we are doing some monetization of low-tier customer data. We are not doing that with any data (low-tier or anything else). That would be hella creepy.
We do track abuse (DDoS attacks, etc.) whoever they hit and use that information to protect other customers. So, in that sense low-tier customers help our overall business, but it's a common lie from our competitors that we are somehow monetizing traffic. Cloudflare's business is pretty simple: work out how to operate our services as cheaply as possible, charge web site/application owners more than that amount.