Ask HN: IPv4 mass scans – do many Cloudflare customers pay pointlessly?

A few months ago I discovered a service called CrimeFlare, which is a security research tool that is used to uncover the "real" IP address of services hidden behind CloudFlare's CDN. The tool works by performing mass IP scans on IPv4 range. As many of us techies are probably aware, there is only a limited number of IPv4 IPs in the world. A number small enough such that specialized software is capable of connecting to every IPv4 address in the world in a matter of hours(on a sufficiently powerful network). There are companies who's entire business model is based on performing mass internet scans, and scan multiple times per day - it is nothing unusual.

This has the unintended consequence of inadvertently revealing the "real" IP of websites attempting to mask their IP behind CloudFlare. This is how the "CrimeFlare" service works under the hood. In order to prevent this, website operators are supposed to configure their server's backends such that they only respond to CloudFlare's IPs. This works of course, however, I suspect that many of their customers are not aware of how CrimeFlare/mass IP scans work and fail to configure their servers correctly. Meaning, a large number of CloudFlare's customers pay for a service which can easily be defeated. Only CloudFlare customers which are tech savvy enough to understand how to configure their servers to only respond to CloudFlare IP's would be able to stop this.

CLoudFlare supposedly has 4.1 million customers. I suspect that the number of CloudFlare customer's who's backend servers are vulnerable(misconfigured to reply to non-CloudFlare IPs - and thus discoverable by CrimeFlare et al.) may be in the hundreds of thousands to millions. Meaning, hundreds of thousands of people could be paying for an easily defeated anti-DDOS measure. It feels wrong that CloudFlare is possibly making tens of millions of dollars off of vulnerable customers who they fail to notify that their sites are vulnerable. I don't believe enough is being done by CloudFlare to warn their customers about the danger of mass-IP scans possibly unmasking their services.