Until late last year that was their policy: https://blog.cloudflare.com/unmetered-mitigation/

Also they specifically refer to volumetric mitigation' as the thing which everyone gets.

The harder to deal with attacks are probably the application aware resource attacks.

I've seen it happen multiple times. Besides, "unmetered" is almost always marketing hype whenever you see it. If your website uses >10TB of non-DDoS traffic per day on CF you are likely to get a call from their sales team soon asking you to upgrade to a pro or business account.

A brief DDoS was (not sure if still is) a common method to expose the real IP because the CDN edge servers could often be easily spooked by a brief surge in traffic and start redirecting DNS back to origin. I suspect this is the kind of "protection" they were really offering: your site will still be down, but at least the backend is never revealed to the world.