Cloudflare is industry leading when it comes to facing those kinds of attacks, though, and it's supported in the "Cloudflare Image Resizing" [0] product.

Also, using a fixed number of sizes might be best practice when it comes to a website you have full control over, and can plan the content for. When it comes to user-generated content, where you want to give the user the opportunity to select a custom crop for an image, you don't necessarily have that kind of control.

The alternative we considered was doing the crop on the client before uploading the image, but that ensures loss of information, and makes it impossible for the user to edit their selection at a future time without re-uploading the image.

[0]: https://developers.cloudflare.com/images/image-resizing