This is a question for the law, not for the mob. The internet, thanks to a completely fucked up legal regime (section 230), is currently very gray.
Facebook and Twitter, which are commonly used to facilitate large-scale violent riots and play host to far more doxxing and cyberbullying than kiwifarms could ever hope to, get a pass despite being the main facilitator of that communication. In contrast, infrastructure services like Cloudflare (and even AWS) have been subject to intense pressure to drop other sites where people say bad things.
Under this theory, we need to be taking Facebook and Twitter offline immediately. And maybe also the phone company too.
Mainstream social media also largely does not moderate nearly well enough to uphold the standard that you are applying to Cloudflare.
I don't think that's right? Legally we've set things up so that no matter how despicable your site is, your telco or ISP can't decide on their own shut you off. They're regulated as infrastructure, and are required to keep doing business with you. They'll shut you off if they receive a court order, but not on their own judgement.
In contrast, nothing prevents Cloudflare from looking at a company's public-facing website (ie as an unprivileged visitor just going to the domain) and deciding whether or not one wants to do business with that company.