The way that Cloudflare works, it likely provides an ability to exfil and track active visitors to the site for three-letter agencies. Forcing Cloudflare to drop them might push them to use non-US services like what happened with 8chan and might not be the best move. Either way, these sites that host ilk always find an anti-DDoS provider >:(