Is it necessary to allow them to terminate/decrypt your TLS connections in order to provide DDOS mitigation? There are other providers besides Cloudflare in this space.
Isn't the DDOS mitigation undermined by exposing the API used by your apps directly?
The (almost) only other provider is Akamai and it's the exact same thing.
Seriously, CloudFlare is doing nothing new and nothing fancy.
Are you claiming that Cloudflare and Akamai are the only providers of DDoS mitigation services? A simple web search will show otherwise.