You’ve figured us out! Damn it; it would have been such a great plan if we hadn’t decided to give DDoS mitigation services away for free. Dagnabit!
I'm sure that the fact that it's highly illegal and unethical are reason enough for Cloudflare to not sell DDoS capacity, but the perverse incentive is still there.
Cloudflare facilitates DDoS, yet Cloudflare "mitigates" for free. "How could this EVER be a business model?", you disingenuously ask.
Simple - if DDoS are common, then more and more people and companies become afraid of them. After a while, everyone wants DDoS mitigation. More and more people move to Cloudflare.
Whether paid or not, you now control more people. Duh.