Until late last year that was their policy: https://blog.cloudflare.com/unmetered-mitigation/

Also they specifically refer to volumetric mitigation' as the thing which everyone gets.

The harder to deal with attacks are probably the application aware resource attacks.