I disagree that the paragraph you quoted is relevant to that. But if it is, then it doesn't seem good that their goal of eradicating cyberattacks is more important to them than actual human lives.
It's not that we value police procedure more than we value the life of the victim. We value rule of law and due process as a society more than any individual gap in applying justice in a given case.
Yes, if we ignore procedure and lock that murderer up anyway, we will have done better justice for the victim. But then we will no longer have a functioning criminal justice system, and that's much worse in the long run.
If Cloudflare allows DDoS to take down these horrible sites, the world will definitely be a better place in many ways. But then it will also be a world where we deal with problems via DDoS and whether you get to keep your site up or have it DDoSed is subject to the whims of Cloudflare. DDoSing sites won't be "wrong" anymore, it'll be a question of whether they deserved it or not.
This is not how we do justice as a society. If someone punches you in the face without instigation, we don't ask if you deserved it, we charge them with assault.
Cloudflare allowing DDoS of content they don't like would be a bit like allowing assault of people we don't like. Maybe there are some people we're happy to see punched in the face, but in the long run, our society suffers.
Protecting people from getting punched in the face, even when they deserve it, is fundamental to maintaining rule of law in society. Wrongdoers are punished after due process of law, not arbitrarily by any vigilante who decides to give them what they deserve.
That is essentially what Cloudflare is arguing.
That very much depends on jurisdiction; don't assume that American laws and norms are universal, nor that they are the best way of doing things.
If Cloudflare would like to be nationalized, I'm happy to have a discussion of applying government rules to them. Until then, they're a private company, "due process" does really not apply.
If we think that protecting sites from DDoS is a public good (and I think that's a good question), that is a task that should fall to government entities.
So you are factually wrong.
And for that matter, a search through google and such didnt turn up anything either. And if its just "x says they did it" without ANY evidence, then how could I believe that?